Profile Types - Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual

in the files attributes (see the chmod and chown man pages) and have /foo/bar w
in its profile.
Attempts to violate Novell AppArmor rules are recorded in /var/log/audit/
audit.log if the audit package is installed or otherwise in /var/log/messages.
In many cases, Novell AppArmor rules prevent an attack from working because neces-
sary files are not accessible and, in all cases, Novell AppArmor confinement restricts
the damage that the attacker can do to the set of files permitted by Novell AppArmor.

21.2 Profile Types

AppArmor knows four different types of profiles: standard profiles, unattached profiles,
local profiles and hats. Standard and unattached profiles are stand-alone profiles, each
stored in a file under /etc/apparmor.d/. Local profiles and hats are children
profiles embedded inside of a parent profile used to provide tighter or alternate confine-
ment for a subtask of an application.
21.2.1 Standard Profiles
The default AppArmor profile is attached to a program by its name, so a profile name
has to match the path to the application it is to confine.
/usr/bin/foo {
...
}
This profile will be automatically used whenever an unconfined process executes /usr/
bin/foo.
21.2.2 Unattached Profiles
Unattached profiles do not reside in the file system namespace and therefore are not
automatically attached to an application. The name of an unattached profile is preceded
by the keyword profile. You can freely choose a profile name, except for the follow-
ing limitations: the name must not begin with a : or . character. If it contains whites-
pace, it must be quoted. If the name begins with a /, the profile is considered to be a
standard profile, so the following two profiles are identical:
Profile Components and Syntax 201