Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 215

21.2.5 Change rules
AppArmor provides change_hat and change_profile rules that control domain
transitioning. change_hat are specified by defining hats in a profile, while
change_profile rules refer to another profile and start with the keyword
change_profile:
change_profile /usr/bin/foobar,
Both change_hat and change_profile provide for an application directed profile
transition, without having to launch a separate application. change_profile provides
a generic one way transition between any of the loaded profiles. change_hat provides
for a returnable parent child transition where an application can switch from the parent
profile to the hat profile and if it provides the correct secret key return to the parent
profile at a later time.
change_profile is best used in situations where an application goes through a
trusted setup phase and then can lower its privilege level. Any resources mapped or
opened during the start-up phase may still be accessible after the profile change, but
the new profile will restrict the opening of new resources, and will even limit some of
the resources opened before the switch. Specifically memory resources will still be
available while capability and file resources (as long as they are not memory mapped)
can be limited.
change_hat is best used in situations where an applications runs a virtual machine
or an interpreter that does not provide direct access to the applications resources (e.g.
Apache's mod_php). Since change_hat stores the return secret key in the applica-
tion's memory the phase of reduced privilege should not have direct access to memory.
It is also important that file access is properly separated, since the hat can restrict ac-
cesses to a file handle but does not close it. If an application does buffering and provides
access to the open files with buffering, the accesses to these files may not be seen by
the kernel and hence not restricted by the new profile.
WARNING: Safety of Domain Transitions
The change_hat and change_profile domain transitions are less secure
than a domain transition done through an exec because they do not affect a
processes memory mappings, nor do they close resources that have already
been opened.
Profile Components and Syntax 203