Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 223

21.7.7 Owner Conditional Rules
The file rules can be extended so that they can be conditional upon the the user being
the owner of the file (the fsuid has to match the file's uid). For this purpose the owner
keyword is prepended to the rule. Owner conditional rules accumulate just as regular
file rules.
owner /home/*/** rw
When using file ownership conditions with link rules the ownership test is done against
the target file so the user must own the file to be able to link to it.
NOTE: Precedence of Regular File Rules
Owner conditional rules are considered a subset of regular file rules. If a regular
file rule overlaps with an owner conditional file rule, the resultant permissions
will be that of the regular file rule.
21.7.8 Deny Rules
Deny rules can be used to annotate or quiet known rejects. The profile generating tools
will not ask about a known reject treated with a deny rule. Such a reject will also not
show up in the audit logs when denied, keeping the log files lean. If this is not desired,
prepend the deny entry with the keyword audit.
It is also possible to use deny rules in combination with allow rules. This allows to
specify a broad allow rule, and then subtract a few known files that should not be al-
lowed. Deny rules can also be combined with owner rules, to deny files owned by the
user. The following example allows read/write access to everything in a users directory
except write access to the .ssh/ files:
deny /home/*/.ssh/** w,
/home/*/** rw,
The extensive use of deny rules is generally not encouraged, because it makes it much
harder to understand what a profile does. However a judicious use of deny rules can
simplify profiles. Therefore the tools only generate profiles denying specific files and
will not make use of globbing in deny rules. Manually edit your profiles to add deny
rules using globbing. Updating such profiles using the tools is safe, because the deny
entries will not be touched.
Profile Components and Syntax 211