Novell APPARMOR 1.2, Руководство администратора, Страница: 19 / 130

icated profile associated with it, the rule should say
/srv/www/cgi-bin/my_hit_counter.pl rix
to cause
my_hit_counter
.pl
to inherit the
usr.sbin.httpd2-prefork
profile.
Some users might find it inconvenient to specify execute permission for every CGI
script that Apache might invoke. Instead, the administrator can grant controlled access
to collections of CGI scripts. For instance, adding the line
/srv/www/cgi-bin/*.{pl,py,pyc} rix
allows Apache to execute all files
in
/srv/www/cgi-bin/
ending in
.pl
(Perl scripts) and
.py
or
.pyc
(Python
scripts). As above, the
ix
part of the rule causes the Python scripts to inherit the Apache
profile, which is appropriate if you do not want to write individual profiles for each
Python script.
NOTE
If you want the subprocess confinement module (
mod_change_hat
) function-
ality when Web applications handle Apache modules (
mod_perl
and
mod
_php
), use the ChangeHat features when you add a profile in YaST or at the
command line. To take advantage of the subprocess confinement, refer to
Section 5.1, “Apache ChangeHat” (page 106).
Profiling Web applications that use
mod_perl
and
mod_php
require slightly different
handling. In this case, the “program” is a script interpreted directly by the module
within the Apache process, so no exec happens. Instead, the Novell AppArmor version
of Apache calls
change_hat()
naming a subprofile (a “hat”) corresponding to the
name of the URI requested.
NOTE
The name presented for the script to execute might not be the URI, depending
on how Apache has been configured for where to look for module scripts. If
you have configured your Apache to place scripts in a different place, the dif-
ferent names appear in syslog when Novell AppArmor complains about access
violations. See
Chapter 4, Managing Profiled Applications (page 77).
For
mod_perl
and
mod_php
scripts, this is the name of the Perl script or the PHP
page requested. For example, adding this subprofile allows the localtime.php page to
execute and access the local system time:
Selecting Programs to Immunize 19