diff --git a/parser/apparmor.d.pod b/parser/apparmor.d.pod index 2040be40a..9ed59610a 100644 --- a/parser/apparmor.d.pod +++ b/parser/apparmor.d.pod @@ -46,7 +46,7 @@ to the policy; this behaviour is modelled after cpp(1). B = ( [ I ] [ I ] )* -B = ( I | I | I )* (variable assignment must come before the profile) +B = ( I | I | I )* (variable assignment must come before the profile) B = '#include' ( I | I ) @@ -58,7 +58,7 @@ B = '#' I [ '\r' ] '\n' B = any characters -B = ( I ) [ I ] [ ] '{' ( I )* '}' +B = ( I ) [ I ] [ I ] '{' ( I )* '}' B = [ 'profile' ] I | 'profile' I @@ -82,9 +82,9 @@ B = ( I | I | I | I = ( I | I | I ) -B = 'profile' I [ I ] [ ] '{' ( I )* '}' +B = 'profile' I [ I ] [ I ] '{' ( I )* '}' -B = ('hat' | '^') I [ ] '{' ( I )* '}' +B = ('hat' | '^') I [ I ] '{' ( I )* '}' B = ( must start with alphanumeric character. see aa_change_hat(2) for a description of how this "hat" is used. IF '^' is used to start a hat then there is no space between the '^' and I) @@ -231,7 +231,7 @@ B = 'set' 'rlimit' [I 'E=' I ] B = ( 'cpu' | 'fsize' | 'data' | 'stack' | 'core' | 'rss' | 'nofile' | 'ofile' | 'as' | 'nproc' | 'memlock' | 'locks' | 'sigpending' | 'msgqueue' | 'nice' | 'rtprio' | 'rttime' ) -B = ( I | I | I ) +B = ( I | I | I ) B = I ( 'K' | 'M' | 'G' ) Only applies to RLIMIT of 'fsize', 'data', 'stack', 'core', 'rss', 'as', 'memlock', 'msgqueue'. @@ -239,7 +239,7 @@ B = number from 0 to max rlimit value. Only applies ot RLIMIT of B = a number between -20 and 19. Only applies to RLIMIT of 'nice' -B = [ I ] [ 'owner' ] ( 'file' | [ 'file' ] ( I I | I I ) [ -E ] ) +B = [ I ] [ 'owner' ] ( 'file' | [ 'file' ] ( I I | I I ) [ -E I ] ) B = ( I | I ) @@ -253,7 +253,7 @@ B = ( 'ix' | 'ux' | 'Ux' | 'px' | 'Px' | 'cx' | 'Cx' | 'pix' | B = name (requires I specified) -B = I [ 'owner' ] 'link' [ 'subset' ] ( 'to' | '-E' ) +B = I [ 'owner' ] 'link' [ 'subset' ] I ( 'to' | '-E' ) I B = '@{' I [ ( I | '_' ) ... ] '}' @@ -532,7 +532,7 @@ determine the profile to transition to from the executable name. It is however possible to specify the name of the profile that the transition should use. -The name of the profile to transition to is specified using the '->' +The name of the profile to transition to is specified using the '-E' followed by the name of the profile to transition to. Eg. /bin/** px -> profile, @@ -572,8 +572,9 @@ or trailing the file glob. Eg. /** rw, # trailing permissions -When a leading permissions is used further rule options and context +When leading permissions are used further rule options and context may be allowed, Eg. + l /foo -> /bar, # lead 'l' link permission is equivalent to link rules =back @@ -593,25 +594,27 @@ Eg. /link* rw, link subset /link* -> /**, - The link rule allows linking of /link to both /file1 or /file2 by - name however because the /link file has 'rw' permissions it is not - allowed to link to /file1 because that would grant an access path - to /file1 with more permissions than the 'r' permissions the profile - specifies. +The link rule allows linking of /link to both /file1 or /file2 by +name however because the /link file has 'rw' permissions it is not +allowed to link to /file1 because that would grant an access path +to /file1 with more permissions than the 'r' permissions the profile +specifies. - A link of /link to /file2 would be allowed because the 'rw' permissions - of /link are a subset of the 'rwk' permissions for /file1. +A link of /link to /file2 would be allowed because the 'rw' permissions +of /link are a subset of the 'rwk' permissions for /file1. The link rule is equivalent to specifying the 'l' link permission as a leading permission with no other file access permissions. When this is done the link rule options can be specified. The following link rule is equivalent to the 'l' permission file rule + link /foo -> bar, l /foo -> /bar, File rules that specify the 'l' permission and don't specify the extend link permissions map to link rules as follows. + /foo l, l /foo, link subset /foo -> /**, @@ -1349,6 +1352,8 @@ with the I qualifier. Specifies that the task must have the same euid/fsuid as the object being referenced by the permission check. +=back + =head3 Qualifier Blocks Rule Qualifiers can be applied to multiple rules at a time by grouping the @@ -1359,8 +1364,6 @@ rules into a rule block. network, } -=back - =head2 #include mechanism AppArmor provides an easy abstraction mechanism to group common file