Capability Entries (Posix.1E); Choosing The Yast Gui, Yast Ncurses Console Or Command-Line Interface - Novell APPARMOR Admin Manual

U s e r ' s G u i d e
will usually require some of the other files listed in the abstraction file
(depending upon local configuration as well as the specific require-
ments of the program). Abstractions can be found in the following
directory:
/etc/subdomain.d/abstractions/
Program Chunks
The program chunks are access controls for specific programs that a
system administrator may wish to control based on local site policy.
Each chunk is used by a single program; these are provided to ease
local-site modifications to policy and updates to policy provided by
Novell. Administrators can modify policy in these files to suit their own
needs, leaving the program profiles unmodified, which will simplify the
task of merging policy updates from Novell into enforced policy at each
site.
The access restrictions in the program chunks are typically very liberal,
and are designed to allow your users access to their files in the least
intrusive way possible, while still allowing system resources to be pro-
tected. An exception to this rule is the postfix* series of program
chunks; these profiles are used to help abstract the location of the
postfix binaries. You will probably not want to reduce the permissions
in the postfix* series. Program Chunks can be found in the following
directory:
/etc/subdomain.d/program-chunks/

Capability Entries (POSIX.1e)

C a p a b i l i t i e s s t a t e me n t s a r e s i mp l y t h e w o r d " c a p a b i l i t y " f o l l o w e d b y t h e
name of the POSIX.1e capability as defined in the capabilities(7) man
page, which you can get to by typing man capabilities in a termi-
nal window.
Choosing the YaST GUI, YaST ncurses Console or
Command-line Interface
There are three ways you can build and manage Novell AppArmor pro-
files, depending on the type of computer environment you prefer. You
20