Some users might find it inconvenient to specify execute permission for every CGI
script that Apache might invoke. Instead, the administrator can grant controlled access
to collections of CGI scripts. For instance, adding the line
/srv/www/cgi-bin/*.{pl,py,pyc} rix
allows Apache to execute all files
in
/srv/www/cgi-bin/
ending in
.pl
(Perl scripts) and
.py
or
.pyc
(Python
scripts). As above, the
ix
part of the rule causes Python scripts to inherit the Apache
profile, which is appropriate if you do not want to write individual profiles for each
Python script.
NOTE
If you want the subprocess confinement module (
apache2-mod-apparmor
)
functionality when Web applications handle Apache modules (
mod_perl
and
mod_php
), use the ChangeHat features when you add a profile in YaST or at
the command line. To take advantage of the subprocess confinement, refer to
Section 5.1, “Apache ChangeHat”
(page 76).
Profiling Web applications that use
mod_perl
and
mod_php
requires slightly different
handling. In this case, the “program” is a script interpreted directly by the module
within the Apache process, so no exec happens. Instead, the Novell AppArmor version
of Apache calls
change_hat()
using a subprofile (a “hat”) corresponding to the
name of the URI requested.
NOTE
The name presented for the script to execute might not be the URI, depending
on how Apache has been configured for where to look for module scripts. If
you have configured your Apache to place scripts in a different place, the dif-
ferent names appear in log file when Novell AppArmor complains about access
violations. See
Chapter 6, Managing Profiled Applications
(page 87).
8
Novell AppArmor Administration Guide
