19
Profile Components and Syntax
When a profile is created for a program, the program can
only
access
the files, modes, and POSIX capabilities specified in the profile. These
restrictions are in
addition
to the native Linux access controls.
Example:
To gain the capability
CAP_CHOWN
, the program must
have
both
access to
CAP_CHOWN
under conventional Linux access
controls (typically, be a root-owned process)
and
have
“
capability
chown
”
i
n
i
t
s
pr
of
i
l
e.
Si
mi
l
ar
l
y,
t
o
be
abl
e
t
o
wr
i
t
e
t
o
t
he
f
i
l
e
/foo/bar
the program must have both the correct user-ID and mode bits set in
the files attributes (see the
chmod
and
chown
man pages) and have
“
/foo/bar w
”
i
n
i
t
s
pr
of
i
l
e.
Attempts to violate Novell AppArmor rules are recorded in
syslog
. In
many cases, Novell AppArmor rules will prevent an attack from work-
ing because necessary files are not accessible, and in all cases Novell
AppArmor confinement bounds the damage that the attacker can do to
the set of files permitted by Novell AppArmor.
#include
#includes are directives that pull in components of other Novell AppAr-
mor profiles to simplify profiles. Include files procure access permis-
sions for programs. By using an include, you can give the program
access to directory paths or files that are also required by other pro-
grams. Using includes can reduce the size of a profile.
By default, the #include statement appends the beginning of the path-
name to /etc/subdomain.d/ which is where it expects to find the include
file. Unlike other profile statements (but similar to C programs),
#include lines do not end with a comma.
Novell AppArmor provides two classes of #includes,
Abstractions
and
Program Chunks
to assist you in profiling your applications.
Abstractions
Abstractions are #includes that are grouped by common application
tasks. These tasks include access to authentication mechanisms,
access to nameservice routines, common graphics requirements, and
system accounting, among others. Files listed in these abstractions
are specific to the named task; programs that require one of these files
