}
}
❶
This loads a file containing variable definitions.
❷
The normalized path to the program that is confined.
❸
The curly braces (
{}
) serve as a container for include statements, subprofiles,
path entries, capability entries, and network entries.
❹
This directive pulls in components of AppArmor profiles to simplify profiles.
❺
Capability entry statements enable each of the 29 POSIX.1e draft capabilities.
❻
A directive determining the kind of network access allowed to the application.
For details, refer to
Section 2.1.1, “Network Access Control”
(page 14).
❼
The curly braces (
{}
) make this rule apply to the path both with and without the
content enclosed by the braces.
❽
A path entry specifying what areas of the file system the program can access. The
first part of a path entry specifies the absolute path of a file (including regular
expression globbing) and the second part indicates permissible access modes (
r
for read,
w
for write, and
x
for execute). A whitespace of any kind (spaces or tabs)
can precede pathnames or separate the pathname from the access modes. Spaces
between the access mode and the trailing comma is optional. Find a comprehensive
overview of the available access modes in
Section 2.1.3, “File Permission Access
Modes”
(page 17).
❾
This variable expands to a value that can be changed without changing the entire
profile.
❿
This section references a subprofile of the application, also known as a “hat”. For
more details on AppArmor's ChangeHat feature, refer to
Chapter 5, Profiling Your
Web Applications Using ChangeHat
(page 75).
TIP: Using Variables in Profiles
With the current AppArmor tools, variables as presented in the above example
can only be used when manually editing and maintaining a profile.
A typical example when variables come in handy are network scenarios in which
user home directories are not mounted in the standard location
/home/
username
, but under a custom location. Find the variable definitions for this
Profile Components and Syntax
13
