mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-30 05:47:59 +00:00
Code Issues Releases Wiki Activity

update the man pages to:

Browse Source 
* add Canonical to the headers of the pod files touched
  * use aa_change_hat() instead of change_hat() (LP: #692216)
  * use http://wiki.apparmor.net in the SEE ALSO
  * use http://https://bugs.launchpad.net/apparmor/+filebug for bugs
  * prefix 'aa-' in SEE ALSO section for utilities (eg, 'aa-complain' for
    'complain')
This commit is contained in:
Jamie Strandboge 2010-12-20 13:47:09 -06:00
parent 77b864527a
commit 49f27414e0
16 changed files with 186 additions and 178 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
changehat/mod_apparmor/mod_apparmor.pod
View File

@ -29,9 +29,9 @@ mod_apparmor - fine-grained AppArmor confinement for Apache
An AppArmor profile applies to an executable program; if a portion of An AppArmor profile applies to an executable program; if a portion of
the program needs different access permissions than other portions, the program needs different access permissions than other portions,
the program can "change hats" via change_hat(2) to a different role, the program can "change hats" via aa_change_hat(2) to a different role,
also known as a subprofile. The mod_apparmor Apache module uses the also known as a subprofile. The mod_apparmor Apache module uses the
change_hat(2) mechanism to offer more fine-grained confinement of dynamic aa_change_hat(2) mechanism to offer more fine-grained confinement of dynamic
elements within Apache such as individual php and perl scripts, while elements within Apache such as individual php and perl scripts, while
still allowing the performance benefits of using mod_php and mod_perl. still allowing the performance benefits of using mod_php and mod_perl.
@ -86,7 +86,7 @@ above).
When profiling with mod_apparmor, it is helpful to keep the following order When profiling with mod_apparmor, it is helpful to keep the following order
of operations in mind: of operations in mind:
On each URI request, mod_apparmor will first change_hat(2) into On each URI request, mod_apparmor will first aa_change_hat(2) into
^HANDLING_UNTRUSTED_INPUT, if it exists. ^HANDLING_UNTRUSTED_INPUT, if it exists.
Then, after performing the initial parsing of the request, mod_apparmor Then, after performing the initial parsing of the request, mod_apparmor
@ -94,15 +94,15 @@ will:
=over 2 =over 2
1. try to change_hat(2) into a matching AAHatName hat if it exists and 1. try to aa_change_hat(2) into a matching AAHatName hat if it exists and
applies, otherwise it will applies, otherwise it will
2. try to change_hat(2) into the URI itself, otherwise it will 2. try to aa_change_hat(2) into the URI itself, otherwise it will
3. try to change_hat(2) into an AADefaultHatName hat if it has been defined 3. try to aa_change_hat(2) into an AADefaultHatName hat if it has been defined
for the server/vhost, otherwise it will for the server/vhost, otherwise it will
4. try to change_hat(2) into the DEFAULT_URI hat, if it exists, otherwise it 4. try to aa_change_hat(2) into the DEFAULT_URI hat, if it exists, otherwise it
will will
5. fall back to the global Apache policy 5. fall back to the global Apache policy
@ -120,7 +120,7 @@ them at L<http://https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO =head1 SEE ALSO
apparmor(7), subdomain.conf(5), apparmor_parser(8), and apparmor(7), subdomain.conf(5), apparmor_parser(8), aa_change_hat(2) and
L<http://wiki.apparmor.net>. L<http://wiki.apparmor.net>.
=cut =cut

32
libraries/libapparmor/doc/aa_change_hat.pod
View File

@ -1,23 +1,22 @@
# $Id$ # $Id$
# This publication is intellectual property of Novell Inc. Its contents # This publication is intellectual property of Novell Inc. and Canonical
# can be duplicated, either in part or in whole, provided that a copyright # Ltd. Its contents can be duplicated, either in part or in whole, provided
# label is visibly located on each copy. # that a copyright label is visibly located on each copy.
# #
# All information found in this book has been compiled with utmost # All information found in this book has been compiled with utmost
# attention to detail. However, this does not guarantee complete accuracy. # attention to detail. However, this does not guarantee complete accuracy.
# Neither SUSE LINUX GmbH, the authors, nor the translators shall be held # Neither SUSE LINUX GmbH, Canonical Ltd, the authors, nor the translators
# liable for possible errors or the consequences thereof. # shall be held liable for possible errors or the consequences thereof.
# #
# Many of the software and hardware descriptions cited in this book # Many of the software and hardware descriptions cited in this book
# are registered trademarks. All trade names are subject to copyright # are registered trademarks. All trade names are subject to copyright
# restrictions and may be registered trade marks. SUSE LINUX GmbH # restrictions and may be registered trade marks. SUSE LINUX GmbH
# essentially adheres to the manufacturer's spelling. # and Canonical Ltd. essentially adhere to the manufacturer's spelling.
# #
# Names of products and trademarks appearing in this book (with or without # Names of products and trademarks appearing in this book (with or without
# specific notation) are likewise subject to trademark and trade protection # specific notation) are likewise subject to trademark and trade protection
# laws and may thus fall under copyright restrictions. # laws and may thus fall under copyright restrictions.
# #
# Please direct suggestions and comments to apparmor-general@forge.novell.com.
=pod =pod
@ -220,14 +219,15 @@ The output when run:
=head1 BUGS =head1 BUGS
None known. If you find any, please report them to bugzilla at None known. If you find any, please report them at
L<http://bugzilla.novell.com>. Note that aa_change_hat(2) provides no L<http://https://bugs.launchpad.net/apparmor/+filebug>. Note that
memory barriers between different areas of a program; if address space aa_change_hat(2) provides no memory barriers between different areas of a
separation is required, then separate processes should be used. program; if address space separation is required, then separate processes
should be used.
=head1 SEE ALSO =head1 SEE ALSO
apparmor(7), apparmor.d(5), apparmor_parser(8), and apparmor(7), apparmor.d(5), apparmor_parser(8), and
L<http://forge.novell.com/modules/xfmod/project/?apparmor>. L<http://wiki.apparmor.net>.
=cut =cut

16
parser/apparmor.d.pod
View File

@ -72,7 +72,7 @@ B<PROTOCOL> = ( 'tcp' | 'udp' | 'icmp' )
B<PROGRAM> = (non-whitespace characters except for '^', must start with '/'. Embedded spaces or tabs must be quoted.) B<PROGRAM> = (non-whitespace characters except for '^', must start with '/'. Embedded spaces or tabs must be quoted.)
B<PROGRAMHAT> = '^' (non-whitespace characters; see change_hat(2) for a description of how this "hat" is used.) B<PROGRAMHAT> = '^' (non-whitespace characters; see aa_change_hat(2) for a description of how this "hat" is used.)
B<PROGRAMCHILD> = I<SUBPROFILE> name B<PROGRAMCHILD> = I<SUBPROFILE> name
@ -102,9 +102,9 @@ memory. Subprofile names are limited to 974 characters. Child profiles can
be used to confine an application in a special way, or when you want the be used to confine an application in a special way, or when you want the
child to be unconfined on the system, but confined when called from the child to be unconfined on the system, but confined when called from the
parent. Hats are a special child profile that can be used with the parent. Hats are a special child profile that can be used with the
change_hat(2) API call. Applications written or modified to use aa_change_hat(2) API call. Applications written or modified to use
change_hat(2) can take advantage of subprofiles to run under different aa_change_hat(2) can take advantage of subprofiles to run under different
confinements, dependent on program logic. Several change_hat(2)-aware confinements, dependent on program logic. Several aa_change_hat(2)-aware
applications exist, including an Apache module, mod_apparmor(5); a PAM applications exist, including an Apache module, mod_apparmor(5); a PAM
module, pam_apparmor; and a Tomcat valve, tomcat_apparmor. Applications module, pam_apparmor; and a Tomcat valve, tomcat_apparmor. Applications
written or modified to use change_profile(2) transition permanently to the written or modified to use change_profile(2) transition permanently to the
@ -552,7 +552,7 @@ B<@{HOME}> and B<@{HOMEDIRS}>. Variables cannot be set in profile scope;
they can only be set before the profile. Therefore, any profiles that they can only be set before the profile. Therefore, any profiles that
use abstractions should either B<#include E<lt>tunables/globalE<gt>> or use abstractions should either B<#include E<lt>tunables/globalE<gt>> or
otherwise ensure that B<@{HOME}> and B<@{HOMEDIRS}> are set before otherwise ensure that B<@{HOME}> and B<@{HOMEDIRS}> are set before
starting the profile definition. The autodep(8) and genprof(8) utilities starting the profile definition. The aa-autodep(8) and aa-genprof(8) utilities
will automatically emit B<#include E<lt>tunables/globalE<gt>> in will automatically emit B<#include E<lt>tunables/globalE<gt>> in
generated profiles. generated profiles.
@ -608,8 +608,8 @@ An example AppArmor profile:
=head1 SEE ALSO =head1 SEE ALSO
apparmor(7), apparmor_parser(8), complain(1), apparmor(7), apparmor_parser(8), aa-complain(1),
enforce(1), change_hat(2), mod_apparmor(5), and aa-enforce(1), aa_change_hat(2), mod_apparmor(5), and
L<http://forge.novell.com/modules/xfmod/project/?apparmor>. L<http://wiki.apparmor.net>.
=cut =cut

16
parser/apparmor.pod
View File

@ -1,8 +1,12 @@
# $Id$ # $Id$
# ---------------------------------------------------------------------- # ----------------------------------------------------------------------
# Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 # Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
# 2008, 2009
# NOVELL (All rights reserved) # NOVELL (All rights reserved)
# #
# Copyright (c) 2010
# Canonical Ltd. (All rights reserved)
#
# This program is free software; you can redistribute it and/or # This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public # modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation. # License published by the Free Software Foundation.
@ -111,7 +115,7 @@ REJECTING. The "name" and process id of the running program are reported,
as well as the profile name and any "hat" that may be active. ("Name" as well as the profile name and any "hat" that may be active. ("Name"
is in quotes, because the process name is limited to 15 bytes; it is the is in quotes, because the process name is limited to 15 bytes; it is the
same as reported through the Berkeley process accounting.) If no hat is same as reported through the Berkeley process accounting.) If no hat is
active (see change_hat(2)) then the profile name is printed for "active". active (see aa_change_hat(2)) then the profile name is printed for "active".
For confined processes running under a profile that has been loaded in For confined processes running under a profile that has been loaded in
complain mode, enforcement will not take place and the log messages complain mode, enforcement will not take place and the log messages
@ -149,10 +153,10 @@ depending upon local configuration.
=head1 SEE ALSO =head1 SEE ALSO
apparmor_parser(8), change_hat(2), apparmor.d(5), apparmor_parser(8), aa_change_hat(2), apparmor.d(5),
subdomain.conf(5), autodep(1), clean(1), subdomain.conf(5), aa-autodep(1), clean(1),
auditd(8), auditd(8),
unconfined(8), enforce(1), complain(1), and aa-unconfined(8), aa-enforce(1), aa-complain(1), and
L<http://forge.novell.com/modules/xfmod/project/?apparmor>. L<http://wiki.apparmor.net>.
=cut =cut

14
parser/apparmor.vim.pod
View File

@ -1,8 +1,12 @@
# $Id$ # $Id$
# ---------------------------------------------------------------------- # ----------------------------------------------------------------------
# Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 # Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
# 2008, 2009
# NOVELL (All rights reserved) # NOVELL (All rights reserved)
# #
# Copyright (c) 2010
# Canonical Ltd. (All rights reserved)
#
# This program is free software; you can redistribute it and/or # This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public # modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation. # License published by the Free Software Foundation.
@ -46,12 +50,12 @@ but it may help you understand your profiles better.
=head1 BUGS =head1 BUGS
B<apparmor.vim> does not properly detect dark versus light backgrounds. B<apparmor.vim> does not properly detect dark versus light backgrounds.
Patches accepted. If you find any bugs, please report them to bugzilla Patches accepted. If you find any bugs, please report them at
at L<http://bugzilla.novell.com>. L<http://https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO =head1 SEE ALSO
vim(1), apparmor(7), apparmor.d(5), change_hat(2), and vim(1), apparmor(7), apparmor.d(5), aa_change_hat(2), and
L<http://forge.novell.com/modules/xfmod/project/?apparmor> L<http://wiki.apparmor.net>.
=cut =cut

14
parser/apparmor_parser.pod
View File

@ -1,8 +1,12 @@
# $Id$ # $Id$
# ---------------------------------------------------------------------- # ----------------------------------------------------------------------
# Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 # Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
# 2008, 2009
# NOVELL (All rights reserved) # NOVELL (All rights reserved)
# #
# Copyright (c) 2010
# Canonical Ltd. (All rights reserved)
#
# This program is free software; you can redistribute it and/or # This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public # modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation. # License published by the Free Software Foundation.
@ -198,12 +202,12 @@ Give a quick reference guide.
=head1 BUGS =head1 BUGS
None known. If you find any, please report them to bugzilla at If you find any bugs, please report them at
L<http://bugzilla.novell.com>. L<http://https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO =head1 SEE ALSO
apparmor(7), apparmor.d(5), subdomain.conf(5), change_hat(2), and apparmor(7), apparmor.d(5), subdomain.conf(5), aa_change_hat(2), and
L<http://forge.novell.com/modules/xfmod/project/?apparmor>. L<http://wiki.apparmor.net>.
=cut =cut

12
parser/subdomain.conf.pod
View File

@ -1,8 +1,12 @@
# $Id$ # $Id$
# ---------------------------------------------------------------------- # ----------------------------------------------------------------------
# Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 # Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
# 2008, 2009
# NOVELL (All rights reserved) # NOVELL (All rights reserved)
# #
# Copyright (c) 2010
# Canonical Ltd. (All rights reserved)
#
# This program is free software; you can redistribute it and/or # This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public # modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation. # License published by the Free Software Foundation.
@ -92,10 +96,10 @@ Setting the initscript to recompile the module will fail on SUSE, as the
module source is no longer installed by default. However, the module has module source is no longer installed by default. However, the module has
been included with the SUSE kernel, so no rebuilding should be necessary. been included with the SUSE kernel, so no rebuilding should be necessary.
If you find any additional bugs, please report them to If you find any additional bugs, please report them at
bugzilla at L<http://bugzilla.novell.com>. L<http://https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO =head1 SEE ALSO
apparmor(7), apparmor_parser(8), and apparmor(7), apparmor_parser(8), and
L<http://forge.novell.com/modules/xfmod/project/?apparmor>. L<http://wiki.apparmor.net>.

8
utils/aa-audit.pod
View File

@ -15,12 +15,12 @@ In this mode security policy is enforced and all access (successes and failures)
=head1 BUGS =head1 BUGS
None. Please report any you find to bugzilla at If you find any bugs, please report them at
L<http://bugzilla.novell.com>. L<http://https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO =head1 SEE ALSO
apparmor(7), apparmor.d(5), aa-enforce(1), aa-complain(1), change_hat(2), and apparmor(7), apparmor.d(5), aa-enforce(1), aa-complain(1), aa_change_hat(2),
L<http://forge.novell.com/modules/xfmod/project/?apparmor>. and L<http://wiki.apparmor.net>.
=cut =cut

28
utils/aa-autodep.pod
View File

@ -1,23 +1,22 @@
# $Id$ # $Id$
# This publication is intellectual property of Novell Inc. Its contents # This publication is intellectual property of Novell Inc. and Canonical
# can be duplicated, either in part or in whole, provided that a copyright # Ltd. Its contents can be duplicated, either in part or in whole, provided
# label is visibly located on each copy. # that a copyright label is visibly located on each copy.
# #
# All information found in this book has been compiled with utmost # All information found in this book has been compiled with utmost
# attention to detail. However, this does not guarantee complete accuracy. # attention to detail. However, this does not guarantee complete accuracy.
# Neither SUSE LINUX GmbH, the authors, nor the translators shall be held # Neither SUSE LINUX GmbH, Canonical Ltd, the authors, nor the translators
# liable for possible errors or the consequences thereof. # shall be held liable for possible errors or the consequences thereof.
# #
# Many of the software and hardware descriptions cited in this book # Many of the software and hardware descriptions cited in this book
# are registered trademarks. All trade names are subject to copyright # are registered trademarks. All trade names are subject to copyright
# restrictions and may be registered trade marks. SUSE LINUX GmbH # restrictions and may be registered trade marks. SUSE LINUX GmbH
# essentially adheres to the manufacturer's spelling. # and Canonical Ltd. essentially adhere to the manufacturer's spelling.
# #
# Names of products and trademarks appearing in this book (with or without # Names of products and trademarks appearing in this book (with or without
# specific notation) are likewise subject to trademark and trade protection # specific notation) are likewise subject to trademark and trade protection
# laws and may thus fall under copyright restrictions. # laws and may thus fall under copyright restrictions.
# #
# Please direct suggestions and comments to apparmor-general@forge.novell.com.
=pod =pod
@ -43,11 +42,12 @@ recursively calling ldd(1) on the executables listed on the command line.
This program does not perform full static analysis of executables, so This program does not perform full static analysis of executables, so
the profiles generated are necessarily incomplete. If you find any bugs, the profiles generated are necessarily incomplete. If you find any bugs,
please report them to bugzilla at L<http://bugzilla.novell.com>. please report them at
L<http://https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO =head1 SEE ALSO
apparmor(7), apparmor.d(5), aa-complain(1), aa-enforce(1), change_hat(2), and apparmor(7), apparmor.d(5), aa-complain(1), aa-enforce(1), aa_change_hat(2),
L<http://forge.novell.com/modules/xfmod/project/?apparmor>. and L<http://wiki.apparmor.net>.
=cut =cut

29
utils/aa-complain.pod
View File

@ -1,23 +1,22 @@
# $Id$ # $Id$
# This publication is intellectual property of Novell Inc. Its contents # This publication is intellectual property of Novell Inc. and Canonical
# can be duplicated, either in part or in whole, provided that a copyright # Ltd. Its contents can be duplicated, either in part or in whole, provided
# label is visibly located on each copy. # that a copyright label is visibly located on each copy.
# #
# All information found in this book has been compiled with utmost # All information found in this book has been compiled with utmost
# attention to detail. However, this does not guarantee complete accuracy. # attention to detail. However, this does not guarantee complete accuracy.
# Neither SUSE LINUX GmbH, the authors, nor the translators shall be held # Neither SUSE LINUX GmbH, Canonical Ltd, the authors, nor the translators
# liable for possible errors or the consequences thereof. # shall be held liable for possible errors or the consequences thereof.
# #
# Many of the software and hardware descriptions cited in this book # Many of the software and hardware descriptions cited in this book
# are registered trademarks. All trade names are subject to copyright # are registered trademarks. All trade names are subject to copyright
# restrictions and may be registered trade marks. SUSE LINUX GmbH # restrictions and may be registered trade marks. SUSE LINUX GmbH
# essentially adheres to the manufacturer's spelling. # and Canonical Ltd. essentially adhere to the manufacturer's spelling.
# #
# Names of products and trademarks appearing in this book (with or without # Names of products and trademarks appearing in this book (with or without
# specific notation) are likewise subject to trademark and trade protection # specific notation) are likewise subject to trademark and trade protection
# laws and may thus fall under copyright restrictions. # laws and may thus fall under copyright restrictions.
# #
# Please direct suggestions and comments to apparmor-general@forge.novell.com.
=pod =pod
@ -38,12 +37,12 @@ to the system log.
=head1 BUGS =head1 BUGS
None. Please report any you find to bugzilla at If you find any bugs, please report them at
L<http://bugzilla.novell.com>. L<http://https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO =head1 SEE ALSO
apparmor(7), apparmor.d(5), aa-enforce(1), change_hat(2), and apparmor(7), apparmor.d(5), aa-enforce(1), aa_change_hat(2), and
L<http://forge.novell.com/modules/xfmod/project/?apparmor>. L<http://wiki.apparmor.net>.
=cut =cut

29
utils/aa-enforce.pod
View File

@ -1,23 +1,22 @@
# $Id$ # $Id$
# This publication is intellectual property of Novell Inc. Its contents # This publication is intellectual property of Novell Inc. and Canonical
# can be duplicated, either in part or in whole, provided that a copyright # Ltd. Its contents can be duplicated, either in part or in whole, provided
# label is visibly located on each copy. # that a copyright label is visibly located on each copy.
# #
# All information found in this book has been compiled with utmost # All information found in this book has been compiled with utmost
# attention to detail. However, this does not guarantee complete accuracy. # attention to detail. However, this does not guarantee complete accuracy.
# Neither SUSE LINUX GmbH, the authors, nor the translators shall be held # Neither SUSE LINUX GmbH, Canonical Ltd, the authors, nor the translators
# liable for possible errors or the consequences thereof. # shall be held liable for possible errors or the consequences thereof.
# #
# Many of the software and hardware descriptions cited in this book # Many of the software and hardware descriptions cited in this book
# are registered trademarks. All trade names are subject to copyright # are registered trademarks. All trade names are subject to copyright
# restrictions and may be registered trade marks. SUSE LINUX GmbH # restrictions and may be registered trade marks. SUSE LINUX GmbH
# essentially adheres to the manufacturer's spelling. # and Canonical Ltd. essentially adhere to the manufacturer's spelling.
# #
# Names of products and trademarks appearing in this book (with or without # Names of products and trademarks appearing in this book (with or without
# specific notation) are likewise subject to trademark and trade protection # specific notation) are likewise subject to trademark and trade protection
# laws and may thus fall under copyright restrictions. # laws and may thus fall under copyright restrictions.
# #
# Please direct suggestions and comments to apparmor-general@forge.novell.com.
=pod =pod
@ -41,12 +40,12 @@ be run to change this behavior.
=head1 BUGS =head1 BUGS
None. Please report any you find to bugzilla at If you find any bugs, please report them at
L<http://bugzilla.novell.com>. L<http://https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO =head1 SEE ALSO
apparmor(7), apparmor.d(5), aa-complain(1), change_hat(2), and apparmor(7), apparmor.d(5), aa-complain(1), aa_change_hat(2), and
L<http://forge.novell.com/modules/xfmod/project/?apparmor>. L<http://wiki.apparmor.net>.
=cut =cut

32
utils/aa-genprof.pod
View File

@ -1,23 +1,22 @@
# $Id$ # $Id$
# This publication is intellectual property of Novell Inc. Its contents # This publication is intellectual property of Novell Inc. and Canonical
# can be duplicated, either in part or in whole, provided that a copyright # Ltd. Its contents can be duplicated, either in part or in whole, provided
# label is visibly located on each copy. # that a copyright label is visibly located on each copy.
# #
# All information found in this book has been compiled with utmost # All information found in this book has been compiled with utmost
# attention to detail. However, this does not guarantee complete accuracy. # attention to detail. However, this does not guarantee complete accuracy.
# Neither SUSE LINUX GmbH, the authors, nor the translators shall be held # Neither SUSE LINUX GmbH, Canonical Ltd, the authors, nor the translators
# liable for possible errors or the consequences thereof. # shall be held liable for possible errors or the consequences thereof.
# #
# Many of the software and hardware descriptions cited in this book # Many of the software and hardware descriptions cited in this book
# are registered trademarks. All trade names are subject to copyright # are registered trademarks. All trade names are subject to copyright
# restrictions and may be registered trade marks. SUSE LINUX GmbH # restrictions and may be registered trade marks. SUSE LINUX GmbH
# essentially adheres to the manufacturer's spelling. # and Canonical Ltd. essentially adhere to the manufacturer's spelling.
# #
# Names of products and trademarks appearing in this book (with or without # Names of products and trademarks appearing in this book (with or without
# specific notation) are likewise subject to trademark and trade protection # specific notation) are likewise subject to trademark and trade protection
# laws and may thus fall under copyright restrictions. # laws and may thus fall under copyright restrictions.
# #
# Please direct suggestions and comments to apparmor-general@forge.novell.com.
=pod =pod
@ -61,7 +60,7 @@ to add to profile and (F)inish.
If the user selects (S)can or hits return, aa-genprof will parse If the user selects (S)can or hits return, aa-genprof will parse
the complain mode logs and iterate through generated violations the complain mode logs and iterate through generated violations
using logprof(1). using aa-logprof(1).
After the user finishes selecting profile entries based on violations After the user finishes selecting profile entries based on violations
that were detected during the program execution, aa-genprof will reload that were detected during the program execution, aa-genprof will reload
@ -74,13 +73,12 @@ and any other profiles that were generated, into enforce mode and exit.
=head1 BUGS =head1 BUGS
None. Please report any you find to bugzilla at If you find any bugs, please report them at
L<http://bugzilla.novell.com>. L<http://https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO =head1 SEE ALSO
apparmor(7), apparmor.d(5), aa-enforce(1), aa-complain(1), change_hat(2), apparmor(7), apparmor.d(5), aa-enforce(1), aa-complain(1), aa_change_hat(2),
aa-logprof(1), logprof.conf(5), and aa-logprof(1), logprof.conf(5), and L<http://wiki.apparmor.net>.
L<http://forge.novell.com/modules/xfmod/project/?apparmor>.
=cut =cut

31
utils/aa-logprof.pod
View File

@ -1,23 +1,22 @@
# $Id$ # $Id$
# This publication is intellectual property of Novell Inc. Its contents # This publication is intellectual property of Novell Inc. and Canonical
# can be duplicated, either in part or in whole, provided that a copyright # Ltd. Its contents can be duplicated, either in part or in whole, provided
# label is visibly located on each copy. # that a copyright label is visibly located on each copy.
# #
# All information found in this book has been compiled with utmost # All information found in this book has been compiled with utmost
# attention to detail. However, this does not guarantee complete accuracy. # attention to detail. However, this does not guarantee complete accuracy.
# Neither SUSE LINUX GmbH, the authors, nor the translators shall be held # Neither SUSE LINUX GmbH, Canonical Ltd, the authors, nor the translators
# liable for possible errors or the consequences thereof. # shall be held liable for possible errors or the consequences thereof.
# #
# Many of the software and hardware descriptions cited in this book # Many of the software and hardware descriptions cited in this book
# are registered trademarks. All trade names are subject to copyright # are registered trademarks. All trade names are subject to copyright
# restrictions and may be registered trade marks. SUSE LINUX GmbH # restrictions and may be registered trade marks. SUSE LINUX GmbH
# essentially adheres to the manufacturer's spelling. # and Canonical Ltd. essentially adhere to the manufacturer's spelling.
# #
# Names of products and trademarks appearing in this book (with or without # Names of products and trademarks appearing in this book (with or without
# specific notation) are likewise subject to trademark and trade protection # specific notation) are likewise subject to trademark and trade protection
# laws and may thus fall under copyright restrictions. # laws and may thus fall under copyright restrictions.
# #
# Please direct suggestions and comments to apparmor-general@forge.novell.com.
=pod =pod
@ -142,7 +141,7 @@ aa-logprof will never suggest "ux" as the default.
=head2 ChangeHat Events =head2 ChangeHat Events
If unknown change_hat(2) events are found, the user is prompted to add a new If unknown aa_change_hat(2) events are found, the user is prompted to add a new
hat, if the events should go into the default hat for this profile based hat, if the events should go into the default hat for this profile based
on the corresponding entry in the defaulthat section of logprof.conf, on the corresponding entry in the defaulthat section of logprof.conf,
or if the following events that run under that hat should be denied or if the following events that run under that hat should be denied
@ -156,13 +155,13 @@ user wants to quit. See capability(7) for details.
=head1 BUGS =head1 BUGS
None. Please report any you find to bugzilla at If you find any bugs, please report them at
L<http://bugzilla.novell.com>. L<http://https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO =head1 SEE ALSO
klogd(8), auditd(8), apparmor(7), apparmor.d(5), change_hat(2), klogd(8), auditd(8), apparmor(7), apparmor.d(5), aa_change_hat(2),
logprof.conf(5), aa-genprof(1), aa-complain(1), aa-enforce(1), and logprof.conf(5), aa-genprof(1), aa-complain(1), aa-enforce(1), and
L<http://forge.novell.com/modules/xfmod/project/?apparmor>. L<http://wiki.apparmor.net>.
=cut =cut

19
utils/aa-status.pod
View File

@ -1,23 +1,22 @@
# $Id$ # $Id$
# This publication is intellectual property of Novell Inc. Its contents # This publication is intellectual property of Novell Inc. and Canonical
# can be duplicated, either in part or in whole, provided that a copyright # Ltd. Its contents can be duplicated, either in part or in whole, provided
# label is visibly located on each copy. # that a copyright label is visibly located on each copy.
# #
# All information found in this book has been compiled with utmost # All information found in this book has been compiled with utmost
# attention to detail. However, this does not guarantee complete accuracy. # attention to detail. However, this does not guarantee complete accuracy.
# Neither SUSE LINUX GmbH, the authors, nor the translators shall be held # Neither SUSE LINUX GmbH, Canonical Ltd, the authors, nor the translators
# liable for possible errors or the consequences thereof. # shall be held liable for possible errors or the consequences thereof.
# #
# Many of the software and hardware descriptions cited in this book # Many of the software and hardware descriptions cited in this book
# are registered trademarks. All trade names are subject to copyright # are registered trademarks. All trade names are subject to copyright
# restrictions and may be registered trade marks. SUSE LINUX GmbH # restrictions and may be registered trade marks. SUSE LINUX GmbH
# essentially adheres to the manufacturer's spelling. # and Canonical Ltd. essentially adhere to the manufacturer's spelling.
# #
# Names of products and trademarks appearing in this book (with or without # Names of products and trademarks appearing in this book (with or without
# specific notation) are likewise subject to trademark and trade protection # specific notation) are likewise subject to trademark and trade protection
# laws and may thus fall under copyright restrictions. # laws and may thus fall under copyright restrictions.
# #
# Please direct suggestions and comments to apparmor-general@forge.novell.com.
=pod =pod
@ -117,12 +116,12 @@ the apparmor control files.
=back =back
If you find any additional bugs, please report them to bugzilla at If you find any additional bugs, please report them at
L<http://bugzilla.novell.com>. L<http://https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO =head1 SEE ALSO
apparmor(7), apparmor.d(5), and apparmor(7), apparmor.d(5), and
L<http://forge.novell.com/modules/xfmod/project/?apparmor>. L<http://wiki.apparmor.net>.
=cut =cut

29
utils/aa-unconfined.pod
View File

@ -1,23 +1,22 @@
# $Id$ # $Id$
# This publication is intellectual property of Novell Inc. Its contents # This publication is intellectual property of Novell Inc. and Canonical
# can be duplicated, either in part or in whole, provided that a copyright # Ltd. Its contents can be duplicated, either in part or in whole, provided
# label is visibly located on each copy. # that a copyright label is visibly located on each copy.
# #
# All information found in this book has been compiled with utmost # All information found in this book has been compiled with utmost
# attention to detail. However, this does not guarantee complete accuracy. # attention to detail. However, this does not guarantee complete accuracy.
# Neither SUSE LINUX GmbH, the authors, nor the translators shall be held # Neither SUSE LINUX GmbH, Canonical Ltd, the authors, nor the translators
# liable for possible errors or the consequences thereof. # shall be held liable for possible errors or the consequences thereof.
# #
# Many of the software and hardware descriptions cited in this book # Many of the software and hardware descriptions cited in this book
# are registered trademarks. All trade names are subject to copyright # are registered trademarks. All trade names are subject to copyright
# restrictions and may be registered trade marks. SUSE LINUX GmbH # restrictions and may be registered trade marks. SUSE LINUX GmbH
# essentially adheres to the manufacturer's spelling. # and Canonical Ltd. essentially adhere to the manufacturer's spelling.
# #
# Names of products and trademarks appearing in this book (with or without # Names of products and trademarks appearing in this book (with or without
# specific notation) are likewise subject to trademark and trade protection # specific notation) are likewise subject to trademark and trade protection
# laws and may thus fall under copyright restrictions. # laws and may thus fall under copyright restrictions.
# #
# Please direct suggestions and comments to apparmor-general@forge.novell.com.
=pod =pod
@ -48,12 +47,12 @@ program only lists processes using TCP and UDP. In short, this
program is unsuitable for forensics use and is provided only as an aid program is unsuitable for forensics use and is provided only as an aid
to profiling all network-accessible processes in the lab. to profiling all network-accessible processes in the lab.
If you find any bugs, please report them to bugzilla at If you find any bugs, please report them at
L<http://bugzilla.novell.com>. L<http://https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO =head1 SEE ALSO
netstat(8), apparmor(7), apparmor.d(5), change_hat(2), and netstat(8), apparmor(7), apparmor.d(5), aa_change_hat(2), and
L<http://forge.novell.com/modules/xfmod/project/?apparmor>. L<http://wiki.apparmor.net>.
=cut =cut

39
utils/logprof.conf.pod
View File

@ -1,23 +1,22 @@
# $Id$ # $Id$
# This publication is intellectual property of Novell Inc. Its contents # This publication is intellectual property of Novell Inc. and Canonical
# can be duplicated, either in part or in whole, provided that a copyright # Ltd. Its contents can be duplicated, either in part or in whole, provided
# label is visibly located on each copy. # that a copyright label is visibly located on each copy.
# #
# All information found in this book has been compiled with utmost # All information found in this book has been compiled with utmost
# attention to detail. However, this does not guarantee complete accuracy. # attention to detail. However, this does not guarantee complete accuracy.
# Neither SUSE LINUX GmbH, the authors, nor the translators shall be held # Neither SUSE LINUX GmbH, Canonical Ltd, the authors, nor the translators
# liable for possible errors or the consequences thereof. # shall be held liable for possible errors or the consequences thereof.
# #
# Many of the software and hardware descriptions cited in this book # Many of the software and hardware descriptions cited in this book
# are registered trademarks. All trade names are subject to copyright # are registered trademarks. All trade names are subject to copyright
# restrictions and may be registered trade marks. SUSE LINUX GmbH # restrictions and may be registered trade marks. SUSE LINUX GmbH
# essentially adheres to the manufacturer's spelling. # and Canonical Ltd. essentially adhere to the manufacturer's spelling.
# #
# Names of products and trademarks appearing in this book (with or without # Names of products and trademarks appearing in this book (with or without
# specific notation) are likewise subject to trademark and trade protection # specific notation) are likewise subject to trademark and trade protection
# laws and may thus fall under copyright restrictions. # laws and may thus fall under copyright restrictions.
# #
# Please direct suggestions and comments to apparmor-general@forge.novell.com.
=pod =pod
@ -25,11 +24,11 @@
=head1 NAME =head1 NAME
logprof.conf - configuration file for expert options that modify the logprof.conf - configuration file for expert options that modify the
behavior of the AppArmor logprof(1) program. behavior of the AppArmor aa-logprof(1) program.
=head1 DESCRIPTION =head1 DESCRIPTION
The logprof(1) program can be configured to have certain default behavior The aa-logprof(1) program can be configured to have certain default behavior
by the contents of logprof.conf. by the contents of logprof.conf.
The B<[qualifiers]> section lists specific programs that should have The B<[qualifiers]> section lists specific programs that should have
@ -56,7 +55,7 @@ If the user is doing something tricky and wants different behavior,
they can tweak or remove the corresponding line in the conf file. they can tweak or remove the corresponding line in the conf file.
The B<[defaulthat]> section lists changehat-aware programs and what hat The B<[defaulthat]> section lists changehat-aware programs and what hat
logprof(1) will collapse the entries to for that program if the user aa-logprof(1) will collapse the entries to for that program if the user
specifies that the access should be allowed, but should not have it's specifies that the access should be allowed, but should not have it's
own hat. own hat.
@ -65,7 +64,7 @@ with respect to globbing suggestions that the user will be prompted with.
The format of each line is-- "<perl glob> = <apparmor glob>". The format of each line is-- "<perl glob> = <apparmor glob>".
When logprof(1) asks about a specific path, if the perl glob matches the When aa-logprof(1) asks about a specific path, if the perl glob matches the
path, it replaces the part of the path that matched with the corresponding path, it replaces the part of the path that matched with the corresponding
apparmor glob and adds it to the list of globbing suggestions. apparmor glob and adds it to the list of globbing suggestions.
@ -104,13 +103,13 @@ Lines starting with # are comments and are ignored.
=head1 BUGS =head1 BUGS
None. Please report any you find to bugzilla at If you find any bugs, please report them at
L<http://bugzilla.novell.com>. L<http://https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO =head1 SEE ALSO
apparmor(7), apparmor.d(5), enforce(1), change_hat(2), apparmor(7), apparmor.d(5), aa-enforce(1), aa_change_hat(2),
complain(1), logprof(1), genprof(1), and aa-complain(1), aa-logprof(1), aa-genprof(1), and
L<http://forge.novell.com/modules/xfmod/project/?apparmor>. L<http://wiki.apparmor.net>.
=cut =cut