To update the profile to the new syntax, use the YaST Update Profile Wizard or the
aa-logprof
command as outlined below.
With this version of AppArmor, a few changes have been made to the profile rule
syntax to better distinguish directory from file access. Therefore, some rules matching
both file and directory paths in the previous version might now just match a file path.
This could lead to AppArmor not being able to access a crucial directory at all and thus
trigger misbehavior of your application and various log messages. The following exam-
ples highlight the most important changes to the path syntax.
Using the old syntax, the following rule would allow access to files and directories in
/proc/net
. It would allow directory access only to read the entries in the directory,
but not give access to files or directories under the directory, e.g.
/proc/net/dir/
foo
would be matched by the asterisk (*), but as
foo
is a file or directory under
dir
,
it cannot be accessed.
/proc/net/* r,
To get the same behavior using the new syntax, you need two rules instead of one. The
first allows access to file under
/proc/net
and the second allows access to directories
under
/proc/net
. Directory access can only be used for listing the contents, not to
actually access files or directories underneath the directory.
/proc/net/* r,
/proc/net/*/ r,
The following rule works similarly both under the old and the new syntax and allows
access to both files and directories under
/proc/net
:
/proc/net/** r,
To distinguish file from directory access using the above expression in the new syntax,
use the following two rules. The first one only allows to recursively access directories
under
/proc/net
while the second one explicitly allows for recursive file access
only.
/proc/net/**/ r,
/proc/net/**[^/] r,
The following rule works similarly both under the old and the new syntax and allows
access to both files and directories beginning with
foo
under
/proc/net
:
/proc/net/foo** r,
120
Novell AppArmor Administration Guide
