aa-logprof Example 2
For example, when profiling vsftpd, see this question:
Profile: /usr/sbin/vsftpd
Path: /y2k.jpg
New Mode: r
[1 - /y2k.jpg]
(A)llow / [(D)eny] / (N)ew / (G)lob / Glob w/(E)xt / Abo(r)t / (F)inish
Several items of interest appear in this question. First, note that vsftpd is asking for a
path entry at the top of the tree, even though vsftpd on openSUSE serves FTP files from
/srv/ftp
by default. This is because httpd2-prefork uses chroot and, for the portion
of the code inside the chroot jail, AppArmor sees file accesses in terms of the chroot
environment rather than the global absolute path.
The second item of interest is that you might want to grant FTP read access to all JPEG
files in the directory, so you could use Glob w/Ext and use the suggested path of
/*.jpg
. Doing so collapses all previous rules granting access to individual
.jpg
files
and forestalls any future questions pertaining to access to
.jpg
files.
Finally, you might want to grant more general access to FTP files. If you select Glob
in the last entry, aa-logprof replaces the suggested path of
/y2k.jpg
with
/*
. Alter-
natively, you might want to grant even more access to the entire directory tree, in which
case you could use the New path option and enter
/**.jpg
(which would grant access
to all
.jpg
files in the entire directory tree) or
/**
(which would grant access to all
files in the directory tree).
These items deal with read accesses. Write accesses are similar, except that it is good
policy to be more conservative in your use of regular expressions for write accesses.
Dealing with execute accesses is more complex. Find an example in
Example 4.1,
“Learning Mode Exception: Controlling Access to Specific Resources”
(page 62).
In the following example, the
/usr/bin/mail
mail client is being profiled and aa-
logprof has discovered that
/usr/bin/mail
executes
/usr/bin/less
as a helper
application to “page” long mail messages. Consequently, it presents this prompt:
/usr/bin/nail -> /usr/bin/less
(I)nherit / (P)rofile / (U)nconfined / (D)eny
Building Profiles from the Command Line
71
