1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
\relax
\providecommand\hyper@newdestlabel[2]{}
\providecommand\HyField@AuxAddToFields[1]{}
\providecommand\HyField@AuxAddToCoFields[2]{}
\citation{apparmor}
\@writefile{toc}{\contentsline {section}{\numberline {1}Introduction}{2}{section.1}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {2}Overview}{2}{section.2}\protected@file@percent }
\newlabel{sec:overview}{{2}{2}{Overview}{section.2}{}}
\@writefile{toc}{\contentsline {section}{\numberline {3}The AppArmor Security Model}{3}{section.3}\protected@file@percent }
\newlabel{sec:model}{{3}{3}{The AppArmor Security Model}{section.3}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.1}Symbolic Links}{3}{subsection.3.1}\protected@file@percent }
\citation{ols06-pai}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.2}Namespaces}{4}{subsection.3.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.3}Disconnected Files and Pseudo File Systems}{4}{subsection.3.3}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.4}Mount}{5}{subsection.3.4}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.5}The Kernel NFS Daemon}{5}{subsection.3.5}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.6}Why are the computed pathnames meaningful?}{5}{subsection.3.6}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.7}Path Permission Checking}{6}{subsection.3.7}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {1}{\ignorespaces File Access Permissions in Profiles}}{7}{table.1}\protected@file@percent }
\newlabel{tab:permissions}{{1}{7}{File Access Permissions in Profiles}{table.1}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.8}Profile Permissions}{7}{subsection.3.8}\protected@file@percent }
\newlabel{sec:permissions}{{3.8}{7}{Profile Permissions}{subsection.3.8}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.9}System Calls Taking File Handles, At System Calls}{8}{subsection.3.9}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.10}File Descriptor Passing and Revalidation}{8}{subsection.3.10}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.11}Deleted Files}{8}{subsection.3.11}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.12}The access System Call}{9}{subsection.3.12}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.13}The ptrace System Call}{9}{subsection.3.13}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.14}Secure Execution}{9}{subsection.3.14}\protected@file@percent }
\newlabel{sec:secure-exec}{{3.14}{9}{Secure Execution}{subsection.3.14}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.15}Exec Mode Merging in Profiles, Exact Matches}{10}{subsection.3.15}\protected@file@percent }
\newlabel{sec:merging}{{3.15}{10}{Exec Mode Merging in Profiles, Exact Matches}{subsection.3.15}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.16}Capabilities}{10}{subsection.3.16}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.17}The sysctl System Call and /proc/sys}{10}{subsection.3.17}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {3.18}Subprofiles aka. Hats}{10}{subsection.3.18}\protected@file@percent }
\citation{dragon86}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.19}Association of Profiles with Processes}{11}{subsection.3.19}\protected@file@percent }
\newlabel{sec:association}{{3.19}{11}{Association of Profiles with Processes}{subsection.3.19}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.20}Profile Loading, Replacement, and Removal}{11}{subsection.3.20}\protected@file@percent }
\@writefile{toc}{\contentsline {section}{\numberline {4}AppArmor Walk-Through}{12}{section.4}\protected@file@percent }
\newlabel{sec:walk-through}{{4}{12}{AppArmor Walk-Through}{section.4}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {4.1}Kernel Patches and Configuration}{12}{subsection.4.1}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.2}The securityfs file system}{13}{subsection.4.2}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.3}Profile Loading}{13}{subsection.4.3}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.4}Anatomy of a Profile}{13}{subsection.4.4}\protected@file@percent }
\@writefile{lot}{\contentsline {table}{\numberline {2}{\ignorespaces Globbing in File Access Rules. Alternation counts as an exact match in file access rules; all others count as wildcards (see Section~\ref {sec:merging}).}}{14}{table.2}\protected@file@percent }
\newlabel{tab:globbing}{{2}{14}{Globbing in File Access Rules. Alternation counts as an exact match in file access rules; all others count as wildcards (see Section~\ref {sec:merging})}{table.2}{}}
\@writefile{toc}{\contentsline {subsection}{\numberline {4.5}Logging}{15}{subsection.4.5}\protected@file@percent }
\@writefile{toc}{\contentsline {subsection}{\numberline {4.6}Generating Profiles By Hand}{15}{subsection.4.6}\protected@file@percent }
\bibcite{apparmor}{1}
\bibcite{ols06-pai}{2}
\bibcite{dragon86}{3}
\gdef \@abspage@last{20}
|
