Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 335

The following rule works similarly both under the old and the new syntax and allows
access to both files and directories beginning with foo under /proc/net:
/proc/net/foo** r,
To distinguish file from directory access in the new syntax and use the ** globbing
pattern, use the following two rules. The first one would have matched both files and
directories in the old syntax, but only matches files in the new syntax due to the missing
trailing slash. The second rule matched neither file nor directory in the old syntax, but
matches directories only in the new syntax:
/proc/net/**foo r,
/proc/net/**foo/ r,
The following rules illustrate how the use of the ? globbing pattern has changed. In the
old syntax, the first rule would have matched both files and directories (four characters,
last character could be any but a slash). In the new syntax, it matches only files (trailing
slash is missing). The second rule would match nothing in the old profile syntax, but
matches directories only in the new syntax. The last rule matches explicitly matches a
file called bar under /proc/net/foo?. Using the old syntax, this rule would have
applied to both files and directories:
/proc/net/foo? r,
/proc/net/foo?/ r,
/proc/net/foo?/bar
To find and resolve issues related to syntax changes, take some time after the update
to check the profiles you want to keep and proceed as follows for each application you
kept the profile for:
1 Make sure that AppArmor is running and that the application's profile is loaded.
2 Start the YaST AppArmor Control Panel and put the application's profile into
complain mode. Log entries are made for any actions violating the current profile,
but the profile is not enforced and the application's behavior not restricted.
3 Run the application covering all the tasks you need this application to be able to
perform.
4 Start the YaST Update Profile Wizard to update the application's profile according
to the log entries generated while running the application.
r,
Support 323