Novell LINUX ENTERPRISE DESKTOP 11, Руководство пользователя, Страница: 253 / 450

link /etc/sysconfig/foo -> /etc/foo.conf,
❼
/bin/mount ux,
/dev/{,u}
❽
random r,
/etc/ld.so.cache r,
/etc/foo/* r,
/lib/ld-*.so* mr,
/lib/lib*.so* mr,
/proc/[0-9]** r,
/usr/lib/** mr,
/tmp/
❾
r,
/tmp/foo.pid wr,
/tmp/foo.* lrw,
/@{HOME}
❿
/.foo_file rw,
/@{HOME}/.foo_lock kw,
owner
11
/shared/foo/** rw,
/usr/bin/foobar cx,
12
/bin/** px -> bin_generic,
13
# a comment about foo's local (children)profile for /usr/bin/foobar.
profile /usr/bin/foobar
14
{
/bin/bash rmix,
/bin/cat rmix,
/bin/more rmix,
/var/log/foobar* rwl,
/etc/foobar r,
}
# foo's hat, bar.
^bar
15
{
/lib/ld-*.so* mr,
/usr/bin/bar px,
/var/spool/* rwl,
}
}
❶
This loads a file containing variable definitions.
❷
The normalized path to the program that is confined.
❸
The curly braces (
{}
) serve as a container for include statements, subprofiles,
path entries, capability entries, and network entries.
❹ This directive pulls in components of AppArmor profiles to simplify profiles.
❺
Capability entry statements enable each of the 29 POSIX.1e draft capabilities.
❻
A directive determining the kind of network access allowed to the application.
For details, refer to
Section 21.5, “Network Access Control” (page 245).
Profile Components and Syntax 239