mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 18:17:09 +00:00
Code Issues Releases Wiki Activity

Update QuickProfileLanguage profiles with explanation of names and attachments

Ryan Lee 2024-08-22 00:00:11 +00:00
parent 82ff9e0b4a
commit d7b8002fb9
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
QuickProfileLanguage.md

@ -16,10 +16,11 @@ the profile.
Profiles
--------
Profiles begin with the name of the profile followed by an optional
flags field, then an opening **{** followed by the rules for the
profile and is finished by a closing **}** If the profile name does not
begin with a **/** then the keyword profile should be prepended. Eg:
Profiles declarations consist of a name and attachment, followed by an optional flags field. At least one of the name and attachment must be present; if only the attachment is present, it will also be considered the name. The attachment represents the path(s) of binaries that a profile is automatically applied to once the profile is loaded into the kernel. If no attachment is present, a profile will not automatically apply to any program but can still be used manually to confine programs using methods like `aa-exec` and the apparmor security option of Docker.
The keyword "profile" is required when a separate name is present and is encouraged even when not required.
Examples:
```
 /usr/bin/firefox {
@ -39,7 +40,7 @@ begin with a **/** then the keyword profile should be prepended. Eg:
 }
```
Profile names can contain file rule globbing characters to allow
Profile attachments can contain file rule globbing characters to allow
them to apply to multiple executables, see File Globbing (below)
for details.