Novell APPARMOR 1.2, Руководство администратора, Страница: 69 / 130

Finally, you might want to grant more general access to FTP files. If you select Glob
in the last entry, logprof replaces the suggested path of
/y2k.jpg
with
/*
. Or you
might want to grant even more access to the entire directory tree, in which case you
could use the New path option and enter
/**.jpg
(which would grant access to all
.jpg
files in the entire directory tree) or
/**
(which would grant access to all files in
the directory tree).
The above deal with read accesses. Write accesses are similar, except that it is good
policy to be more conservative in your use of regular expressions for write accesses.
Dealing with execute accesses is more complex. You must decide which of the three
kinds of execute permissions to grant:
Inherit (ix)
The child inherits the parent's profile, running with the same access controls as the
parent. This mode is useful when a confined program needs to call another confined
program without gaining the permissions of the target's profile or losing the permis-
sions of the current profile. This mode is often used when the child program is a
helper application, such as the
/usr/bin/mail
client using the less program
as a pager or the Mozilla Web browser using the Acrobat program to display PDF
files.
profile (px)
The child runs using its own profile, which must be loaded into the kernel. If the
profile is not present, attempts to execute the child fails with permission denied.
This is most useful if the parent program is invoking a global service, such as DNS
lookups or sending mail via your system's MTA.
unconfined (ux)
The child runs completely unconfined without any Novell AppArmor profile applied
to the executed resource.
In the following example, the
/usr/bin/mail
mail client is being profiled and
logprof has discovered that
/usr/bin/mail
executes
/usr/bin/less
as a helper
application to “page” long mail messages. Consequently, it presents this prompt:
/usr/bin/nail -> /usr/bin/less
(I)nherit / (P)rofile / (U)nconstrained / (D)eny
Building Novell AppArmor Profiles 69