...
/usr/*bash cx -> local_profile,
...
profile local_profile
{
...
}
}
NOTE: Difference Between Normal and Named Transitions
When used with globbing, normal transitions provide a “one to many” relation-
ship—
/bin/** px
will transition to
/bin/ping
,
/bin/cat
, etc, depending
on the program being run.
Named transitions provide a “many to one” relationship—all programs that
match the rule regardless of their name will transition to the specified profile.
Named profile transitions show up in the log as having the mode
Nx
. The name
of the profile to be changed to is listed in the
name2
field.
21.8.8 Inheritance Fallback for Profile
Transitions
The
px
and
cx
transitions specify a hard dependency—if the specified profile does not
exist, the exec will fail. With the inheritance fallback, the execution will succeed but
inherit the current profile. To specify inheritance fallback,
ix
is combined with
cx
,
Cx
,
px
and
Px
into the modes
cix
,
Cix
,
pix
and
Pix
. The fallback modes can be
used with named profile transitions, too.
21.8.9 Variable Settings in Execution Modes
When choosing one of the Px, Cx or Ux execution modes, take into account that the
following environment variables are removed from the environment before the child
process inherits it. As a consequence, applications or processes relying on any of these
variables do not work anymore if the profile applied to them carries Px, Cx or Ux flags:
Profile Components and Syntax
255
Содержание LINUX ENTERPRISE DESKTOP 11
Страница 1: ...SUSE Linux Enterprise Server www novell com 11 March 17 2009 Security Guide...
Страница 9: ...32 7 Managing Audit Event Records Using Keys 433 33 Useful Resources 435...
Страница 10: ......
Страница 29: ...Part I Authentication...
Страница 30: ......
Страница 55: ...Figure 4 2 YaST LDAP Server Configuration LDAP A Directory Service 41...
Страница 126: ......
Страница 127: ...Part II Local Security...
Страница 128: ......
Страница 158: ......
Страница 173: ...Part III Network Security...
Страница 174: ......
Страница 194: ......
Страница 197: ...Figure 16 2 Scenario 2 Figure 16 3 Scenario 3 Configuring VPN Server 183...
Страница 210: ......
Страница 228: ......
Страница 229: ...Part IV Confining Privileges with Novell AppArmor...
Страница 230: ......
Страница 274: ......
Страница 300: ......
Страница 328: ......
Страница 340: ......
Страница 342: ......
Страница 386: ......
Страница 387: ...Part V The Linux Audit Framework...
Страница 388: ......