Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 212

A link pair rule specifying the source and the target of a link. See
"Link Pair"
The curly braces ({}) make this rule apply to the path both with and without the
content enclosed by the braces.
A path entry specifying what areas of the file system the program can access. The
first part of a path entry specifies the absolute path of a file (including regular
expression globbing) and the second part indicates permissible access modes (for
example r for read, w for write, and x for execute). A whitespace of any kind
(spaces or tabs) can precede pathnames or separate the pathname from the access
modes. Spaces between the access mode and the trailing comma is optional. Find
a comprehensive overview of the available access modes in
Permission Access Modes"
This variable expands to a value that can be changed without changing the entire
profile.
An owner conditional rule, granting read and write permission on files owned by
11
the user. Refer to
information.
This entry defines a transition to the local profile /usr/bin/foobar. Find a
12
comprehensive overview of the available execute modes in
Modes"
A named profile transition to the profile bin_generic located in the global scope.
13
See
The local profile /usr/bin/foobar is defined in this section.
14
This section references a "hat" subprofile of the application. For more details on
15
AppArmor's ChangeHat feature, refer to
tions Using ChangeHat
When a profile is created for a program, the program can access only the files, modes,
and POSIX capabilities specified in the profile. These restrictions are in addition to the
native Linux access controls.
Example:
to CAP_CHOWN under conventional Linux access controls (typically, be a root-owned
process) and have the capability chown in its profile. Similarly, to be able to write to
the file /foo/bar the program must have both the correct user ID and mode bits set
200 Security Guide
(page 210) for more information.
Section 21.7.7, "Owner Conditional Rules"
(page 212).
Section 21.8.7, "Named Profile Transitions"
(page 275).
To gain the capability CAP_CHOWN, the program must have both access
(page 209).
Chapter 25, Profiling Your Web Applica-
Section 21.7.6,
Section 21.7, "File
(page 211) for more
Section 21.8, "Execute
(page 214) for details.