Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 283

• You can avoid adding the helper applications, such as tar and rpm, to the /usr/
bin/mail profile so that when /usr/bin/mail runs /usr/bin/less in
this context, the less program is far less dangerous than it would be without App-
Armor protection.
In other circumstances, you might instead want to use the Profile option. This has two
effects on aa-logprof:
• The rule written into the profile uses px, which forces the transition to the child's
own profile.
• aa-logprof constructs a profile for the child and starts building it, in the same way
that it built the parent profile, by assigning events for the child process to the child's
profile and asking the aa-logprof user questions.
If a confined program forks and executes another program, aa-logprof sees this and
asks the user which execution mode should be used when launching the child process.
The execution modes of inherit, profile, unconfined or an option to deny the execution
are presented.
If a separate profile exists for the child process, the default selection is profile. If a
profile does not exist, the default is inherit. The inherit option, or ix, is described in
Section 21.7, "File Permission Access Modes"
The profile option indicates that the child program should run in its own profile—a
secondary question asks whether to sanitize the environment that the child program
inherits from the parent. If you choose to sanitize the environment, this places the exe-
cution modifier Px in your AppArmor profile. If you select not to sanitize, px is placed
in the profile and no environment sanitizing occurs. The default for the execution mode
is px if you select profile execution mode.
The unconfined execution mode is not recommended and should only be used in cases
where there is no other option to generate a profile for a program reliably. Selecting
unconfined opens a warning dialog asking for confirmation of the choice. If you are
sure and choose Yes, a second dialog ask whether to sanitize the environment. Choosing
Yes uses the execution mode Ux in your profile. Choosing No uses the execution mode
ux for your profile. The default value selected is Ux for unconfined execution mode.
(page 209).
Building Profiles from the Command Line 271