Example 5.1
Example phpsysinfo-dev Hat
^phpsysinfo {
#include <abstractions/base>
/bin/df ix,
/bin/bash ix,
/dev/tty rw,
/etc/SuSE-release r,
/etc/fstab r,
/etc/hosts r,
/etc/mtab r,
/proc/** r,
/sbin/lspci ix,
/srv/www/htdocs/sysinfo/** r,
/sys/bus/pci/devices r,
/sys/devices/** r,
/usr/bin/who ix,
/usr/share/pci.ids r,
/var/log/apache2/{access,error}_log w,
/var/run/utmp r,
}
NOTE: Hat and Parent Profile Relationship
The profile
^phpsysinfo-dev
is only valid in the context of a process running
under the parent profile
httpd2-prefork
.
5.1.2 Adding Hats and Entries to Hats
When you use the Edit Profile dialog (for instructions, refer to
Section 3.3, “Editing
Profiles”
(page 33)) or when you add a new profile using Manually Add Profile (for
instructions, refer to
Section 3.2, “Manually Adding a Profile”
(page 32)), you are
given the option of adding hats (subprofiles) to your Novell AppArmor profiles. Add
a ChangeHat subprofile from the AppArmor Profile Dialog window as in the following.
Profiling Your Web Applications Using ChangeHat
81
