Novell APPARMOR 1.2, Руководство администратора, Страница: 22 / 130

# profile to confine klogd
❶
/sbin/klogd
❷
{
❸
#include <abstractions/base>
❹
capability sys_admin,
❺
/boot/* r
❻
,
/proc/kmsg r,
/sbin/klogd r,
/var/run/klogd.pid lw,
}
❶ A comment naming the program that is confined by this profile. Always precede
comments like this with the
#
sign.
❷ The absolute path to the program that is confined.
❸ The curly braces
{}
serve as a container for include statements of other profiles
as well as for path and capability entries.
❹ This directive pulls in components of Novell AppArmor profiles to simplify pro-
files.
❺ Capability entry statements enable each of the 29 POSIX.1e draft capabilities.
❻ A path entry specifying what areas of the file system the program can access. The
first part of a path entry specifies the absolute path of a file (including regular
expression globbing) and the second part indicates permissible access modes (
r
for read,
w
for write, and
x
for execute). A white space of any kind (spaces or
tabs) can precede pathnames or separate the pathname from the access modes.
White space between the access mode and the trailing comma is optional.
When a profile is created for a program, the program can access only the files, modes,
and POSIX capabilities specified in the profile. These restrictions are in addition to the
native Linux access controls.
Example: To gain the capability
CAP_CHOWN
, the program must have both access
to
CAP_CHOWN
under conventional Linux access controls (typically, be a root-owned
process) and have capability chown in its profile. Similarly, to be able to write to the
file
/foo/bar
the program must have both the correct user ID and mode bits set in
the files attributes (see the
chmod
and
chown
man pages) and have
/foo/bar w
in
its profile.
Attempts to violate Novell AppArmor rules are recorded in syslog. In many cases,
Novell AppArmor rules prevent an attack from working because necessary files are not
22