using an include, you can give the program access to directory paths or files that are
also required by other programs. Using includes can reduce the size of a profile.
By default, AppArmor adds
/etc/apparmor.d
to the path in the
#include
statement. AppArmor expects the include files to be located in
/etc/apparmor.d
.
Unlike other profile statements (but similar to C programs),
#include
lines do not
end with a comma.
To assist you in profiling your applications, Novell AppArmor provides two classes of
#include
s: abstractions and program chunks.
2.2.1 Abstractions
Abstractions are
#include
s that are grouped by common application tasks. These
tasks include access to authentication mechanisms, access to name service routines,
common graphics requirements, and system accounting. Files listed in these abstractions
are specific to the named task. Programs that require one of these files usually require
some of the other files listed in the abstraction file (depending on the local configuration
as well as the specific requirements of the program). Find abstractions in
/etc/
apparmor.d/abstractions
.
2.2.2 Program Chunks
The program-chunks directory (
/etc/apparmor.d/program-chunks
) contains
some chunks of profiles that are specific to program suites and not generally useful
outside of the suite, thus are never suggested for use in profiles by the profile wizards
(aa-logprof and aa-genprof). Currently program chunks are only available for the
postfix program suite.
2.3 Capability Entries (POSIX.1e)
Capabilities statements are simply the word
capability
followed by the name of
the POSIX.1e capability as defined in the
capabilities(7)
man page.
22
Novell AppArmor Administration Guide