Novell APPARMOR Admin Manual page 28

U s e r ' s G u i d e
Matching" o n p a g e6 9 .
• Actual Path Name: This is the literal path that the program
needs access to so that it can run properly.
For Figure 2: Select the option that will satisfy that request by
choosing one of the following:
• Inherit: stay in the same security profile (parent's profile)
• Profile: requires that a separate profile exists for the executed
program
• Unconfined: program executed without a security profile.
note: unless absolutely necessary you don't want to run uncon-
fined
10.Once you select a directory path, you need to process it as an entry
into the Novell AppArmor profile by clicking Allow or Deny. If you
are not satisfied with the directory path entry as it is displayed, you
can also Glob or Edit it.
The following options are available to process the learning mode
entries and to build the profile:
• Allow: Click the Allow button if you want to grant the program
access to the specified directory path entries. The Profile Creation
Wizard suggests file permission access. For more information on
t h i s , r e f e r t o " File Permission Access Modes" o n p a g e6 9
• Deny: Click the Deny button to prevent the program from access-
ing the specified directory path entries.
• Glob: When you click the Glob button once, the directory path is
modified (by using wildcards) to include all files in the suggested
entry directory. When you click it twice, access will be granted to all
files and subdirectories beneath the one shown.
F o r mo r e i n f o r ma t i o n o n g l o b b i n g s y n t a x , r e f e r t o " Path Names and
Regular Expression Matching" o n p a g e6 9 .
• G l o b w / E x t : When you click the Glob w/Ext button, the original
directory path is modified while retaining the filename extension.
With one click, /etc/apache2/file.ext becomes /etc/apache2/*.ext,
adding the wildcard (asterisk) in place of the file name. This will
allow the program to access all files in the suggested directory that
end with the ".ext" extension. When you click it twice, access will be
granted to all files (with the particular extension) and subdirectories
beneath the one shown.
• Edit: Select the Edit button to edit the highlighted line. The new
line will appear at the bottom of the list.
28