Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 268 / 450

21.8.5 Inherit Execute Mode (ix)
ix
prevents the normal AppArmor domain transition on
execve(2)
when the profiled
program executes the named program. Instead, the executed resource inherits the current
profile.
This mode is useful when a confined program needs to call another confined program
without gaining the permissions of the target's profile or losing the permissions of the
current profile. There is no version to scrub the environment because
ix
executions do
not change privileges.
Incompatible with
cx
,
ux
, and
px
. Implies
m
.
21.8.6 Allow Executable Mapping (m)
This mode allows a file to be mapped into memory using
mmap(2)
's
PROT_EXEC
flag. This flag marks the pages executable. It is used on some architectures to provide
non executable data pages, which can complicate exploit attempts. AppArmor uses this
mode to limit which files a well-behaved program (or all programs on architectures
that enforce non executable memory access controls) may use as libraries, to limit the
effect of invalid
-L
flags given to
ld(1)
and
LD_PRELOAD
,
LD_LIBRARY_PATH
,
given to
ld.so(8)
.
21.8.7 Named Profile Transitions
By default the
px
and
cx
(and their clean exec variants, too) transition to a profile
who's name matches the executable name. With named profile transitions, you can
specify a profile to be transitioned to. This is useful if multiple binaries should share a
single profile, or if they should use a different profile than their name would specify.
Named profile transitions can be used in conjunction with
cx
,
Cx
,
px
and
Px
. Currently
there is a limit of twelve named profile transitions per profile.
Named profile transitions use
->
to indicate the name of the profile that should be
transitioned to:
/usr/bin/foo
{
/bin/** px -> shared_profile,
254 Security Guide