Novell APPARMOR 1.2, Руководство администратора, Страница: 68 / 130

Glob w/Ext
Clicking this modifies the original directory path while retaining the filename ex-
tension. For example,
/etc/apache2/file.ext
becomes
/etc/apache2/
*.ext
, adding the wild card (asterisk) in place of the filename. This allows the
program to access all files in the suggested directory that end with the
.ext
exten-
sion. Double-clicking it grants access to all files (with the particular extension) and
subdirectories beneath the one shown.
Edit
Lets you edit the selected line. The new edited line appears at the bottom of the
list.
Abort
Aborts logprof, dumping all rule changes entered so far and leaving all profiles
unmodified.
Finish
Closes logprof, saving all rule changes entered so far and modifying all profiles.
logprof Example 2
In an example from profiling vsftpd, we see this question:
Profile: /usr/sbin/vsftpd
Path: /y2k.jpg
New Mode: r
[1 - /y2k.jpg]
(A)llow / [(D)eny] / (N)ew / (G)lob / Glob w/(E)xt / Abo(r)t / (F)inish
Several items of interest appear in this question. First, note that vsftpd is asking for a
path entry at the top of the tree, even though vsftpd on SUSE Linux serves FTP files
from
/srv/ftp
by default. This is because httpd2-prefork uses chroot and, for the
portion of the code inside the chroot jail, Novell AppArmor sees file accesses in terms
of the chroot environment rather than the global absolute path.
The second item of interest is that you might want to grant FTP read access to all of
the JPEG files in the directory, so you could use Glob w/Ext and use the suggested path
of
/*.jpg
. Doing so collapses all previous rules granting access to individual
.jpg
files and forestalls any future questions pertaining to access to .jpg files.
68