Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 226

21.8.5 Inherit Execute Mode (ix)
ix prevents the normal AppArmor domain transition on execve(2) when the profiled
program executes the named program. Instead, the executed resource inherits the current
profile.
This mode is useful when a confined program needs to call another confined program
without gaining the permissions of the target's profile or losing the permissions of the
current profile. There is no version to scrub the environment because ix executions do
not change privileges.
Incompatible with cx, ux, and px. Implies m.
21.8.6 Allow Executable Mapping (m)
This mode allows a file to be mapped into memory using mmap(2)'s PROT_EXEC
flag. This flag marks the pages executable. It is used on some architectures to provide
non executable data pages, which can complicate exploit attempts. AppArmor uses this
mode to limit which files a well-behaved program (or all programs on architectures
that enforce non executable memory access controls) may use as libraries, to limit the
effect of invalid -L flags given to ld(1) and LD_PRELOAD, LD_LIBRARY_PATH,
given to ld.so(8).
21.8.7 Named Profile Transitions
By default the px and cx (and their clean exec variants, too) transition to a profile
who's name matches the executable name. With named profile transitions, you can
specify a profile to be transitioned to. This is useful if multiple binaries should share a
single profile, or if they should use a different profile than their name would specify.
Named profile transitions can be used in conjunction with cx, Cx, px and Px. Currently
there is a limit of twelve named profile transitions per profile.
Named profile transitions use -> to indicate the name of the profile that should be
transitioned to:
/usr/bin/foo
{
/bin/** px -> shared_profile,
214 Security Guide