TIP
The actual executable file for
/usr/bin/mail
turns out to be
/usr/bin/
nail
, which is not a typographical error.
The program
/usr/bin/less
appears to be a simple one for scrolling through text
that is more than one screen long and that is in fact what
/usr/bin/mail
is using
it for. However, less is actually a large and powerful program that makes use of many
other helper applications, such as tar and rpm.
TIP
Run
less
on a tar file or an RPM file and it shows you the inventory of these
containers.
You do not want to run
rpm
automatically when reading mail messages (that leads di-
rectly to a Microsoft* Outlook–style virus attack, because rpm has the power to install
and modify system programs), so, in this case, the best choice is to use Inherit. This
results in the less program executed from this context running under the profile for
/usr/bin/mail
. This has two consequences:
• You need to add all of the basic file accesses for
/usr/bin/less
to the profile
for
/usr/bin/mail
.
• You can avoid adding the helper applications, such as tar and rpm, to the
/usr/
bin/mail
profile so that when
/usr/bin/mail
runs
/usr/bin/less
in
this context, the less program is far less dangerous than it would be without App-
Armor protection.
In other circumstances, you might instead want to use the Profile option. This has two
effects on aa-logprof:
• The rule written into the profile uses px, which forces the transition to the child's
own profile.
• aa-logprof constructs a profile for the child and starts building it, in the same way
that it built the parent profile, by assigning events for the child process to the child's
profile and asking the aa-logprof user questions.
72
Novell AppArmor Administration Guide
