mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-09-03 15:55:46 +00:00
Code Issues Releases Wiki Activity

QuickProfileLanguage: a couple more code quote touchups

Steve Beattie
2017-11-03 17:26:46 -07:00
parent 7b5d370eb3
commit ab254ea687
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
QuickProfileLanguage.md

@@ -283,7 +283,9 @@ The following file permissions are supported:
The owner keyword can be used as a qualifier making permission The owner keyword can be used as a qualifier making permission
conditional on owning the file (process fsuid == file's uid). conditional on owning the file (process fsuid == file's uid).
` owner /foo rw,` ```
 owner /foo rw,
```
The following are in development: The following are in development:
@@ -324,14 +326,18 @@ ix or ux transition. It is often a good idea to use 'PUx' instead of
program has an AppArmor profile added later. For example, if a confined program has an AppArmor profile added later. For example, if a confined
program should be allowed to run 'evince', then the profile might have: program should be allowed to run 'evince', then the profile might have:
` /usr/bin/evince PUx,` ```
 /usr/bin/evince PUx,
```
The px and cx rules (and all their variants) can also be modified to The px and cx rules (and all their variants) can also be modified to
specify a profile by name instead of using the profile that matches specify a profile by name instead of using the profile that matches
the name of the executable. This is done by providing a **->** the name of the executable. This is done by providing a **->**
transition arrow and the name of the profile. transition arrow and the name of the profile.
` /foo px -> profile1,` ```
 /foo px -> profile1,
```
For directories, the UNIX execute permission maps to search access For directories, the UNIX execute permission maps to search access
and AppArmor does not further control directory search access. In and AppArmor does not further control directory search access. In