Novell LINUX ENTERPRISE DESKTOP 11, Manual, Page: 266 / 450

21.8 Execute Modes
Execute modes, also named profile transitions, consist of the following modes:
Discrete profile execute mode px
Discrete local profile execute mode cx
Unconstrained execute mode ux
Inherit execute mode ix
Allow
PROT_EXEC
with
mmap(2)
calls
m
21.8.1 Discrete Profile Execute Mode (px)
This mode requires that a discrete security profile is defined for a resource executed at
an AppArmor domain transition. If there is no profile defined, the access is denied.
WARNING: Using the Discrete Profile Execute Mode
px
does not scrub the environment of variables such as
LD_PRELOAD
. As a
result, the calling domain may have an undue amount of influence over the
called item.
Incompatible with
Ux
,
ux
,
Px
, and
ix
.
21.8.2 Discrete Local Profile Execute Mode
(cx)
As
px
, but instead of searching the global profile set,
cx
only searches the local profiles
of the current profile. This profile transition provides a way for an application to have
alternate profiles for helper applications.
252 Security Guide