Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I know the AppArmor profiles resides in /etc/apparmor.d/, but I do not know how to interpret it. Any translation would be enlightening.

share|improve this question
    
You mean the configuration from /etc/apparmor.d/usr.bin.firefox? It looks very explanatory. –  Lekensteyn May 9 '11 at 13:13
    
@Lekensteyn, no I do not know how to read it. And sorry about the new question, I posted it mistakenly after I couldn't find my own question. –  Oxwivi Jun 27 '11 at 18:56
    
It would be better if you had studied the syntax and then asked some more specific questions. There's plenty of documentation online. You can't expect anyone to explain the profile line by line. wiki.ubuntu.com/AppArmor –  arrange Jun 28 '11 at 8:10
    
@arrange, I was hoping someone would. :) You can't expect every user to learn to effects when considering using it. –  Oxwivi Jun 28 '11 at 8:16
    
@Oxwivi: I get your point, but right now there are 618 lines in FF-related apparmor profile files... –  arrange Jun 28 '11 at 8:28
show 3 more comments

1 Answer

up vote 3 down vote accepted

The only thing confusing in there are the codes and your interpret them like this:

'r'  read
'w'  write
'm'  memory map as executable
'k'  file locking
'l'  creation hard links
'ix' execute and inherit this profile
'Px' execute under another profile, after cleaning the environment
'Ux' execute unconfined, after cleaning the environment

The rest of the file are mainly directories, files and libraries with sometimes some parameters in front (like PROC and HOME which seem easy to understand) and regexes to make it more flexible and sometimes a 'deny' or 'owner' in front of the line (these seem to be self-explanatory to me: they deny access and limit actions in case it is the owner doing them).

Regarding PROC:

Example:

# for networking
  network inet stream,
  network inet6 stream,
  @{PROC}/[0-9]*/net/if_inet6 r,
  @{PROC}/[0-9]*/net/ipv6_route r,

and do

cd /proc/
ls *

See all the directories with digits? These correspond to each running process. If any of them contain a directory net (network) and that holds a file if_net6 or ipv6_route they are considered read.

share|improve this answer
    
HOME I understand, but not PROC. –  Oxwivi Jun 28 '11 at 7:26
    
Also there are some lines without any of the parameters defined. –  Oxwivi Jun 28 '11 at 7:37
    
so the code behind it says what permission it gets systemwide for every user. –  Rinzwind Jun 28 '11 at 7:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.