diff --git a/QuickProfileLanguage.md b/QuickProfileLanguage.md index f7047d4..a60e18d 100644 --- a/QuickProfileLanguage.md +++ b/QuickProfileLanguage.md @@ -16,10 +16,11 @@ the profile. Profiles -------- -Profiles begin with the name of the profile followed by an optional -flags field, then an opening **{** followed by the rules for the -profile and is finished by a closing **}** If the profile name does not -begin with a **/** then the keyword profile should be prepended. Eg: +Profiles declarations consist of a name and attachment, followed by an optional flags field. At least one of the name and attachment must be present; if only the attachment is present, it will also be considered the name. The attachment represents the path(s) of binaries that a profile is automatically applied to once the profile is loaded into the kernel. If no attachment is present, a profile will not automatically apply to any program but can still be used manually to confine programs using methods like `aa-exec` and the apparmor security option of Docker. + +The keyword "profile" is required when a separate name is present and is encouraged even when not required. + +Examples: ```  /usr/bin/firefox { @@ -39,7 +40,7 @@ begin with a **/** then the keyword profile should be prepended. Eg:  } ``` -Profile names can contain file rule globbing characters to allow +Profile attachments can contain file rule globbing characters to allow them to apply to multiple executables, see File Globbing (below) for details.