mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-30 05:47:59 +00:00
Code Issues Releases Wiki Activity

Update EnvironmentVariables

John Johansen 2020-05-25 08:00:51 +00:00
parent 2b17d137b6
commit 3ebb92b1f3
1 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
EnvironmentVariables.md

@ -36,7 +36,7 @@ The basic structure of an environment rule is as follows.
ENVIRONMENT_RULE := ( AUDIT_QUALIFIER QUALIFIER 'environment' VARIABLES ('='VALUES)? [ ':=' VALUE ] ',' | 'environment '{' ( AUDIT_QUALIFIER QUALIFIER VARIABLES ['=' VALUES] [ ':=' VALUE ] ',' )* '}' ) ENVIRONMENT_RULE := ( AUDIT_QUALIFIER QUALIFIER 'environment' VARIABLES ('='VALUES)? [ ':=' VALUE ] ',' | 'environment '{' ( AUDIT_QUALIFIER QUALIFIER VARIABLES ['=' VALUES] [ ':=' VALUE ] ',' )* '}' )
AUDIT_QUALIFIER := (audit|quiet|access) AUDIT_QUALIFIER := (audit|quiet|access)
QUALIFIER := (deny|require|filter|set) QUALIFIER := (allow|deny|require|filter|delete|set)
VARIABLES := pattern of variable names VARIABLES := pattern of variable names
VALUES := pattern of variable values that the rule matches VALUES := pattern of variable values that the rule matches
``` ```
@ -48,7 +48,8 @@ The qualifiers that can be used are
- allow - if the rule is matched the environment variable will be allowed - allow - if the rule is matched the environment variable will be allowed
- deny - if the rule is matched execution will be denied - deny - if the rule is matched execution will be denied
- require - if the rule is not matched execution will be denied - require - if the rule is not matched execution will be denied
- filter - if the rule is matched the variable will be filtered (removed) from the environment. ???Filter part of rule - filter - if the rule is matched the variable's value will be filtered . ???Filter part of rule
- delete - if the rule is matched the variable will deleted from the environment.
- set - if the rule is matched the variable will be set to the provided value - set - if the rule is matched the variable will be set to the provided value
??? IF no environment rules default allow, else default deny ??? ??? IF no environment rules default allow, else default deny ???
@ -125,6 +126,19 @@ profile foo {
``` ```
```
profile foo {
environment {
# make this a black list
allow *,
deny LD_PRELOAD,
delete PYTHON_PATH,
filter PATH=?????,
require HOME,
set APPARMOR_SESSION := yes,
}
}
```
profile python /usr/bin/python { profile python /usr/bin/python {