diff --git a/parser/apparmor.d.pod b/parser/apparmor.d.pod index 5c9789666..661d924e1 100644 --- a/parser/apparmor.d.pod +++ b/parser/apparmor.d.pod @@ -195,7 +195,7 @@ B 'attr' '=' ( I | '(' '"' I '"' | I ')' ) B 'opt' '=' ( I | '(' '"' I '"' | I ')' ) -B = [ I ] [ 'owner' ] [ 'file' ] ( '"' I '"' | I ) I [ -E ] ',' +B = [ I ] [ 'owner' ] [ 'file' ] ( ( '"' I '"' | I ) I | [I ( '"' I '"' | I ) ) [ -E ] ',' B = (must start with '/' (after variable expansion), B have special meanings; see below. May include I. Rules with embedded spaces or tabs must be quoted. Rules must end with '/' to apply to directories.) @@ -513,6 +513,19 @@ on the new link, it must match the original file exactly. Allows the program to be able lock a file with this name. This permission covers both advisory and mandatory locking. +=item B + +File rules can be specified with the access permission either leading +or trailing the file glob. Eg. + + rw /**, # leading permissions + + /** rw, # trailing permissions + +When a leading permissions is used further rule options and context +may be allowed, Eg. + l /foo -> /bar, # lead 'l' link permission is equivalent to link rules + =back =head2 Comments