ACC SHELL
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Novell AppArmor (2.3.1) Quick Start</title><link rel="stylesheet" href="susebooks.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Documentation"><link rel="up" href="book.quickstarts.html" title="Quick Start Manuals"><link rel="prev" href="art.gnomequick.html" title="GNOME Quick Start"><link rel="next" href="bk07ar05.html" title="Legal Information"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header" border="0" class="bctable"><tr><td width="80%"><div class="breadcrumbs"><p><a href="index.html"> Documentation</a><span class="breadcrumbs-sep"> > </span><a href="book.quickstarts.html">Quick Start Manuals</a><span class="breadcrumbs-sep"> > </span><strong><a accesskey="p" title="GNOME Quick Start" href="art.gnomequick.html"><span>◀</span></a> <a accesskey="n" title="Legal Information" href="bk07ar05.html"><span>▶</span></a></strong></p></div></td></tr></table></div><div lang="en" class="article" title="Novell AppArmor (2.3.1) Quick Start"><div class="titlepage"><div><div><h2 class="title"><a name="art.aaquick"></a>Novell AppArmor (2.3.1) Quick Start<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#art.aaquick">¶</a></span></h2></div><div class="buildtime"><p>12/27/2010</p></div></div><hr></div><div class="toc"><p><b>Contents</b></p><dl><dt><span class="sect1"><a href="art.aaquick.html#sec.aaquick.modes">1. AppArmor Modes</a></span></dt><dt><span class="sect1"><a href="art.aaquick.html#sec.aaquick.startstop">2. Starting and Stopping AppArmor</a></span></dt><dt><span class="sect1"><a href="art.aaquick.html#sec.aaquick.cmdline">3. AppArmor Command Line Tools</a></span></dt><dt><span class="sect1"><a href="art.aaquick.html#sec.aaquick.methods">4. Methods of Profiling</a></span></dt><dt><span class="sect1"><a href="art.aaquick.html#sec.aaquick.learning_mode">5. Learning Mode</a></span></dt><dt><span class="sect1"><a href="art.aaquick.html#sec.aaquick.example">6. Example Profile</a></span></dt><dt><span class="sect1"><a href="art.aaquick.html#sec.aaquick.profile_structure">7. Structure of a Profile</a></span></dt><dt><span class="sect1"><a href="art.aaquick.html#sec.aaquick.pam_apparmor">8. Confining Users with pam_apparmor</a></span></dt><dt><span class="sect1"><a href="art.aaquick.html#sec.aaquick.audit">9. Logging and Auditing</a></span></dt><dt><span class="sect1"><a href="art.aaquick.html#sec.aaquick.directories_files">10. Directories and Files</a></span></dt><dt><span class="sect1"><a href="art.aaquick.html#id421846">11. For More Information</a></span></dt><dt><span class="sect1"><a href="art.aaquick.html#id421874">12. Legal Notice</a></span></dt><dt><span class="sect1"><a href="art.aaquick.html#id421934">13. GNU Free Documentation License</a></span></dt></dl></div><div class="abstract" title="Abstract"><p class="title"><b>Abstract</b></p><p>
This document helps you understand the main concepts behind
Novell® AppArmor—the content of AppArmor profiles. Learn how to create or
modify AppArmor profiles. You can create and manage AppArmor profiles in three
different ways. The most convenient interface to AppArmor is provided by
means of the AppArmor YaST modules, which can be used either in graphical
or ncurses mode. The same functionality is provided by the AppArmor command
line tools or by editing the profiles in a text editor.
</p></div><div class="sect1" title="1. AppArmor Modes"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sec.aaquick.modes"></a>1. AppArmor Modes<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.modes">¶</a></span></h2></div></div></div><div class="variablelist"><dl><dt><span class="term">complain/learning</span></dt><dd><p>
In complain or learning mode, violations of AppArmor profile rules, such
as the profiled program accessing files not permitted by the profile,
are detected. The violations are permitted, but also logged. This mode
is convenient for developing profiles and is used by the AppArmor tools
for generating profiles.
</p></dd><dt><span class="term">enforce</span></dt><dd><p>
Loading a profile in enforcement mode enforces the policy defined in
the profile as well as reports policy violation attempts to syslogd.
</p></dd></dl></div></div><div class="sect1" title="2. Starting and Stopping AppArmor"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sec.aaquick.startstop"></a>2. Starting and Stopping AppArmor<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.startstop">¶</a></span></h2></div></div></div><p>
Use the <span class="command"><strong>rcapparmor</strong></span> command with one of the following
parameters:
</p><div class="variablelist"><dl><dt><span class="term"><code class="option">start</code>
</span></dt><dd><p>
Load the kernel module, mount securityfs, parse and load profiles.
Profiles and confinement are applied to any application started after
this command was executed. Processes already running at the time AppArmor
is started continue to run unconfined.
</p></dd><dt><span class="term"><code class="option">stop</code>
</span></dt><dd><p>
Unmount securityfs, and invalidate profiles.
</p></dd><dt><span class="term"><code class="option">reload</code>
</span></dt><dd><p>
Reload profiles.
</p></dd><dt><span class="term"><code class="option">status</code>
</span></dt><dd><p>
If AppArmor is enabled, output how many profiles are loaded in complain or
enforce mode.
</p></dd></dl></div><p>
Use the <span class="command"><strong>rcaaeventd</strong></span> command to control event logging
with aa-eventd. Use the <code class="option">start</code> and <code class="option">stop</code>
options to toggle the status of the aa-eventd and check its status using
<code class="option">status</code>.
</p></div><div class="sect1" title="3. AppArmor Command Line Tools"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sec.aaquick.cmdline"></a>3. AppArmor Command Line Tools<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.cmdline">¶</a></span></h2></div></div></div><div class="variablelist"><dl><dt><span class="term">autodep</span></dt><dd><p>
Guess basic AppArmor profile requirements. autodep creates a stub profile
for the program or application examined. The resulting profile is
called <span class="quote">“<span class="quote">approximate</span>”</span> because it does not necessarily
contain all of the profile entries that the program needs in order to
be confined properly.
</p></dd><dt><span class="term">complain</span></dt><dd><p>
Set an AppArmor profile to complain mode.
</p><p>
Manually activating complain mode (using the command line) adds a flag
to the top of the profile, so that <span class="command"><strong>/bin/foo</strong></span> becomes
<span class="command"><strong>/bin/foo flags=(complain)</strong></span>.
</p></dd><dt><span class="term">enforce</span></dt><dd><p>
Set an AppArmor profile to enforce mode from complain mode.
</p><p>
Manually activating enforce mode (using the command line) removes mode
flags from the top of the profile, so that <span class="command"><strong>/bin/foo
flags=(complain)</strong></span> becomes <span class="command"><strong>/bin/foo</strong></span>.
</p></dd><dt><span class="term">genprof</span></dt><dd><p>
Generate or update a profile. When running, you must specify a program
to profile. If the specified program is not an absolute path, genprof
searches the <code class="envar">$PATH</code> variable. If a profile does not
exist, genprof creates one using autodep.
</p></dd><dt><span class="term">logprof</span></dt><dd><p>
Manage AppArmor profiles. logprof is an interactive tool used to review
the learning or complain mode output found in the AppArmor syslog entries
and to generate new entries in AppArmor profiles.
</p></dd><dt><span class="term">unconfined</span></dt><dd><p>
Output a list of processes with open TCP or UDP ports that do not have
AppArmor profiles loaded.
</p></dd></dl></div></div><div class="sect1" title="4. Methods of Profiling"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sec.aaquick.methods"></a>4. Methods of Profiling<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.methods">¶</a></span></h2></div></div></div><div class="variablelist"><dl><dt><span class="term">Stand-Alone Profiling</span></dt><dd><p>
Using genprof. Suitable for profiling small applications.
</p></dd><dt><span class="term">Systemic Profiling</span></dt><dd><p>
Suitable for profiling large numbers of programs all at once and for
profiling applications that may run <span class="quote">“<span class="quote">forever.</span>”</span>
</p><p>
To apply systemic profiling, proceed as follows:
</p><div class="orderedlist"><ol class="orderedlist" type="1"><li><p>
Create profiles for the individual programs that make up your
application (autodep).
</p></li><li><p>
Put relevant profiles into learning or complain mode.
</p></li><li><p>
Exercise your application.
</p></li><li><p>
Analyze the log (logprof).
</p></li><li><p>
Repeat Steps 3-4.
</p></li><li><p>
Edit the profiles.
</p></li><li><p>
Return to enforce mode.
</p></li><li><p>
Reload all profiles (<span class="command"><strong>rcapparmor restart</strong></span>).
</p></li></ol></div></dd></dl></div></div><div class="sect1" title="5. Learning Mode"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sec.aaquick.learning_mode"></a>5. Learning Mode<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.learning_mode">¶</a></span></h2></div></div></div><p>
When using genprof, logprof, or YaST in learning mode, you get several
options for how to proceed:
</p><div class="variablelist"><dl><dt><span class="term">Allow</span></dt><dd><p>
Grant access.
</p></dd><dt><span class="term">Deny</span></dt><dd><p>
Prevent access.
</p></dd><dt><span class="term">Glob</span></dt><dd><p>
Modify the directory path to include all files in the suggested
directory.
</p></dd><dt><span class="term">Glob w/Ext</span></dt><dd><p>
Modify the original directory path while retaining the filename
extension. This allows the program to access all files in the
suggested directories that end with the specified extension.
</p></dd><dt><span class="term">Edit</span></dt><dd><p>
Enable editing of the highlighted line. The new (edited) line appears
at the bottom of the list. This option is called
<span class="guimenu">New</span> in the logprof and genprof command line tools.
</p></dd><dt><span class="term">Abort</span></dt><dd><p>
Abort logprof or YaST, losing all rule changes entered so far and
leaving all profiles unmodified.
</p></dd><dt><span class="term">Finish</span></dt><dd><p>
Close logprof or YaST, saving all rule changes entered so far and
modifying all profiles.
</p></dd></dl></div></div><div class="sect1" title="6. Example Profile"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sec.aaquick.example"></a>6. Example Profile<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.example">¶</a></span></h2></div></div></div><pre class="screen">
#include<tunables/global>
@{HOME} = /home/*/ /root/ # variable
/usr/bin/foo {
#include <abstractions/base>
network inet tcp,
capability setgid,
/bin/mount ux,
/dev/{,u}random r,
/etc/ld.so.cache r,
/etc/foo/* r,
/lib/ld-*.so* mr,
/lib/lib*.so* mr,
/proc/[0-9]** r,
/usr/lib/** mr,
/tmp/ r,
/tmp/foo.pid wr,
/tmp/foo.* lrw,
/@{HOME}/.foo_file rw,
/@{HOME}/.foo_lock kw,
link /etc/sysconfig/foo -> /etc/foo.conf,
deny /etc/shadow w,
owner /home/*/** rw,
/usr/bin/foobar cx,
/bin/** px -> bin_generic
# comment on foo's local profile, foobar.
foobar {
/bin/bash rmix,
/bin/cat rmix,
/bin/more rmix,
/var/log/foobar* rwl,
/etc/foobar r,
}
}</pre></div><div class="sect1" title="7. Structure of a Profile"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sec.aaquick.profile_structure"></a>7. Structure of a Profile<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure">¶</a></span></h2></div></div></div><p>
Profiles are simple text files in the
<code class="filename">/etc/apparmor.d</code> directory. They consist of several
parts: #include, capability entries, rules, and <span class="quote">“<span class="quote">hats.</span>”</span>
</p><div class="sect2" title="7.1. #include"><div class="titlepage"><div><div><h3 class="title"><a name="sec.aaquick.profile_structure.include"></a>7.1. #include<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure.include">¶</a></span></h3></div></div></div><p>
This is the section of an AppArmor profile that refers to an include file,
which mediates access permissions for programs. By using an include, you
can give the program access to directory paths or files that are also
required by other programs. Using includes can reduce the size of a
profile. It is good practice to select includes when suggested.
</p><p>
To assist you in profiling your applications, AppArmor provides three
classes of <code class="filename">#includes</code>: abstractions, program chunks,
and tunables.
</p><p>
Abstractions are <code class="filename">#includes</code> that are grouped by
common application tasks. These tasks include access to authentication
mechanisms, access to name service routines, common graphics
requirements, and system accounting (for example, base, consoles,
kerberosclient, perl, user-mail, user-tmp, authentication, bash,
nameservice).
</p><p>
Program chunks are access controls for specific programs that a system
administrator might want to control based on local site policy. Each
chunk is used by a single program.
</p><p>
Tunables are global variable definitions. When used in a profile, these
variables expand to a value that can be changed without changing the
entire profile. Therefore your profiles become portable to different
environments.
</p></div><div class="sect2" title="7.2. Local Variables"><div class="titlepage"><div><div><h3 class="title"><a name="sec.aaquick.profile_structure.variables"></a>7.2. Local Variables<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure.variables">¶</a></span></h3></div></div></div><p>
Local variables are defined at the head of a profile. Use local
variables to create shortcuts for paths, for example to provide the base
for a chrooted path:
</p><pre class="screen">@{CHROOT_BASE}=/tmp/foo
/sbin/syslog-ng {
...
# chrooted applications
@{CHROOT_BASE}/var/lib/*/dev/log w,
@{CHROOT_BASE}/var/log/** w,
...
}</pre></div><div class="sect2" title="7.3. Aliases"><div class="titlepage"><div><div><h3 class="title"><a name="sec.aaquick.profile_structure.alias"></a>7.3. Aliases<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure.alias">¶</a></span></h3></div></div></div><p>
Alias rules provide an alternative form of path rewriting to using
variables, and are done post variable resolution:
</p><pre class="screen">alias /home/ -> /mnt/users/</pre></div><div class="sect2" title="7.4. Network Access Control"><div class="titlepage"><div><div><h3 class="title"><a name="sec.aaquick.profile_structure.nac"></a>7.4. Network Access Control<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure.nac">¶</a></span></h3></div></div></div><p>
AppArmor provides network access mediation based on network domain and type:
</p><pre class="screen">/bin/ping {
network inet dgram,
network inet raw,
...
}</pre><p>
The example would allow IPv4 network access of the datagram and raw type
for the ping command. For details on the network rule syntax, refer to
the Part “Confining Privileges with Novell AppArmor” (↑Security Guide).
</p></div><div class="sect2" title="7.5. Capability Entries (POSIX.1e)"><div class="titlepage"><div><div><h3 class="title"><a name="sec.aaquick.profile_structure.cap"></a>7.5. Capability Entries (POSIX.1e)<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure.cap">¶</a></span></h3></div></div></div><p>
Capabilities statements are simply the word <span class="quote">“<span class="quote">capability</span>”</span>
followed by the name of the POSIX.1e capability as defined in the
<span class="command"><strong>capabilities(7)</strong></span> man page.
</p></div><div class="sect2" title="7.6. Rules: General Options for Files and Directories"><div class="titlepage"><div><div><h3 class="title"><a name="sec.aaquick.profile_structure.rules_general"></a>7.6. Rules: General Options for Files and Directories<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure.rules_general">¶</a></span></h3></div></div></div><div class="informaltable"><table border="1"><colgroup><col><col></colgroup><thead><tr><th>
<p>
<span class="emphasis"><em>Option</em></span>
</p>
</th><th>
<p>
<span class="emphasis"><em>File</em></span>
</p>
</th></tr></thead><tbody><tr><td>
<p>
read
</p>
</td><td>
<p>
<code class="literal">r</code>
</p>
</td></tr><tr><td>
<p>
write
</p>
</td><td>
<p>
<code class="literal">w</code>
</p>
</td></tr><tr><td>
<p>
link
</p>
</td><td>
<p>
<code class="literal">l</code>
</p>
</td></tr><tr><td>
<p>
file locking
</p>
</td><td>
<p>
<code class="literal">k</code>
</p>
</td></tr><tr><td>
<p>
file append (mutually exclusive to <code class="literal">w</code>)
</p>
</td><td>
<p>
<code class="literal">a</code>
</p>
</td></tr></tbody></table></div></div><div class="sect2" title="7.7. Rules: Link Pair"><div class="titlepage"><div><div><h3 class="title"><a name="sec.aaquick.profile_structure.link_pair"></a>7.7. Rules: Link Pair<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure.link_pair">¶</a></span></h3></div></div></div><p>
The link mode grants permission to create links to arbitrary files,
provided the link has a subset of the permissions granted by the target
(subset permission test). By specifying origin and destination, the link
pair rule provides greater control over how hard links are created. Link
pair rules by, default, do not enforce the link subset permission test
that the standard rules link permission requires. To force the rule to
require the test the subset keyword is used. The following rules are
equivalent:
</p><pre class="screen">/link l,
link subset /link -> /**,</pre></div><div class="sect2" title="7.8. Rules: Denying rules"><div class="titlepage"><div><div><h3 class="title"><a name="sec.aaquick.profile_structure.deny"></a>7.8. Rules: Denying rules<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure.deny">¶</a></span></h3></div></div></div><p>
AppArmor provides <code class="literal">deny</code> rules which are standard rules but
with the keyword <code class="literal">deny</code> prepended. They are used to
remember known rejects, and quiet them so the reject messages don't fill
up the log files. For more information see
Part “Confining Privileges with Novell AppArmor” (↑Security Guide).
</p></div><div class="sect2" title="7.9. Rules: Owner Conditional Rules"><div class="titlepage"><div><div><h3 class="title"><a name="sec.aaquick.profile_structure.owner"></a>7.9. Rules: Owner Conditional Rules<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure.owner">¶</a></span></h3></div></div></div><p>
The file rules can be extended so that they can be conditional upon the
the user being the owner of the file, by prepending the keyword
<code class="literal">owner</code> to the rule. Owner conditional rules accumulate
just as regular file rules and are considered a subset of regular file
rules. If a regular file rule overlaps with an owner conditional file
rule, the resulting permissions will be that of the regular file rule.
</p></div><div class="sect2" title="7.10. Rules: Defining Execute Permissions"><div class="titlepage"><div><div><h3 class="title"><a name="sec.aaquick.profile_structure.exec"></a>7.10. Rules: Defining Execute Permissions<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure.exec">¶</a></span></h3></div></div></div><p>
For executables that may be called from the confined programs, the
profile creating tools ask you for an appropriate mode, which is also
reflected directly in the profile itself:
</p><div class="informaltable"><table border="1"><colgroup><col><col><col></colgroup><thead><tr><th>
<p>
<span class="emphasis"><em>Option</em></span>
</p>
</th><th>
<p>
<span class="emphasis"><em>File</em></span>
</p>
</th><th>
<p>
<span class="emphasis"><em>Description</em></span>
</p>
</th></tr></thead><tbody><tr><td>
<p>
Inherit
</p>
</td><td>
<p>
<code class="literal">ix</code>
</p>
</td><td>
<p>
Stay in the same (parent's) profile.
</p>
</td></tr><tr><td>
<p>
Profile
</p>
</td><td>
<p>
<code class="literal">px</code>
</p>
</td><td>
<p>
Requires that a separate profile exists for the executed program.
Use <code class="literal">Px</code> to make use of environment scrubbing.
</p>
</td></tr><tr><td>
<p>
Local profile
</p>
</td><td>
<p>
<code class="literal">cx</code>
</p>
</td><td>
<p>
Requires that a local profile exists for the executed program. Use
<code class="literal">Cx</code> to make use of environment scrubbing.
</p>
</td></tr><tr><td>
<p>
Unconstrained
</p>
</td><td>
<p>
<code class="literal">ux</code>
</p>
</td><td>
<p>
Executes the program without a profile. Avoid running programs in
unconstrained or unconfined mode for security reasons. Use
<code class="literal">Ux</code> to make use of environment scrubbing.
</p>
</td></tr><tr><td>
<p>
Allow Executable Mapping
</p>
</td><td>
<p>
<code class="literal">m</code>
</p>
</td><td>
<p>
allow <code class="envar">PROT_EXEC</code> with <span class="command"><strong>mmap(2)</strong></span>
calls
</p>
</td></tr></tbody></table></div><div class="warning"><table border="0" cellpadding="3" cellspacing="0" width="100%" summary="Warning: Running in ux Mode"><tr class="head"><td width="32"><img alt="[Warning]" src="admon/warning.png"></td><th align="left">Running in ux Mode</th></tr><tr><td colspan="2" align="left" valign="top"><p>
Avoid running programs in ux mode as much as possible. A program
running in ux mode is not only totally unprotected by AppArmor, but child
processes inherit certain environment variables from the parent that
might influence the child's execution behavior and create possible
security risks.
</p></td></tr></table></div><p>
For more information about the different file execute modes, refer to
the <span class="command"><strong>apparmor.d(5)</strong></span> man page. For more information
about setgid and setuid environment scrubbing, refer to the
<span class="command"><strong>ld.so(8)</strong></span> man page.
</p></div><div class="sect2" title="7.11. Rules: Paths and Globbing"><div class="titlepage"><div><div><h3 class="title"><a name="sec.aaquick.profile_structure.pathnames_globbing"></a>7.11. Rules: Paths and Globbing<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure.pathnames_globbing">¶</a></span></h3></div></div></div><p>
AppArmor supports explicit handling of directories. Use a trailing
<code class="literal">/</code> for any directory path that needs to be explicitly
distinguished:
</p><div class="variablelist"><dl><dt><span class="term"><code class="filename">/some/random/example/* r</code>
</span></dt><dd><p>
Allow read access to files in the
<code class="filename">/some/random/example</code> directory.
</p></dd><dt><span class="term"><code class="filename">/some/random/example/ r</code>
</span></dt><dd><p>
Allow read access to the directory only.
</p></dd><dt><span class="term"><code class="filename">/some/**/ r</code>
</span></dt><dd><p>
Give read access to any directories below <code class="filename">/some</code>.
</p></dd><dt><span class="term"><code class="filename">/some/random/example/** r</code>
</span></dt><dd><p>
Give read access to files and directories under
<code class="filename">/some/random/example</code>.
</p></dd><dt><span class="term"><code class="filename">/some/random/example/**[^/] r</code>
</span></dt><dd><p>
Give read access to files under
<code class="filename">/some/random/example</code>. Explicitly exclude
directories (<code class="literal">[^/]</code>).
</p></dd></dl></div><p>
To spare users from specifying similar paths all over again, AppArmor
supports basic globbing:
</p><div class="informaltable"><table border="1"><colgroup><col><col></colgroup><thead><tr><th>
<p>
<span class="emphasis"><em>Glob</em></span>
</p>
</th><th>
<p>
<span class="emphasis"><em>Description</em></span>
</p>
</th></tr></thead><tbody><tr><td>
<p>
<code class="literal">*</code>
</p>
</td><td>
<p>
Substitutes for any number of characters, except
<code class="literal">/</code>.
</p>
</td></tr><tr><td>
<p>
<code class="literal">**</code>
</p>
</td><td>
<p>
Substitutes for any number of characters, including
<code class="literal">/</code>.
</p>
</td></tr><tr><td>
<p>
<code class="literal">?</code>
</p>
</td><td>
<p>
Substitutes for any single character, except <code class="literal">/</code>.
</p>
</td></tr><tr><td>
<p>
<code class="literal">[ abc ]</code>
</p>
</td><td>
<p>
Substitutes for the single character <code class="literal">a</code>,
<code class="literal">b</code>, or <code class="literal">c</code>.
</p>
</td></tr><tr><td>
<p>
<code class="literal">[ a-c ]</code>
</p>
</td><td>
<p>
Substitutes for the single character <code class="literal">a</code>,
<code class="literal">b</code>, or <code class="literal">c</code>.
</p>
</td></tr><tr><td>
<p>
<code class="literal">{ ab,cd }</code>
</p>
</td><td>
<p>
Expand to one rule to match <code class="literal">ab</code> and another to
match <code class="literal">cd</code>.
</p>
</td></tr><tr><td>
<p>
<code class="literal">[ ^a ]</code>
</p>
</td><td>
<p>
Substitutes for any character except <code class="literal">a</code>.
</p>
</td></tr></tbody></table></div></div><div class="sect2" title="7.12. Rules: Auditing rules"><div class="titlepage"><div><div><h3 class="title"><a name="sec.aaquick.profile_structure.audit"></a>7.12. Rules: Auditing rules<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure.audit">¶</a></span></h3></div></div></div><p>
AppArmor provides the user with the ability to audit given rules so that
when they are matched, an audit message will appear in the audit log. To
enable audit messages for a given rule the audit keyword is prepended to
the rule:
</p><pre class="screen">audit /etc/foo/* rw,</pre></div><div class="sect2" title="7.13. Rules: Setting Capabilities"><div class="titlepage"><div><div><h3 class="title"><a name="sec.aaquick.profile_structure.set_capability"></a>7.13. Rules: Setting Capabilities<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure.set_capability">¶</a></span></h3></div></div></div><p>
Normally, AppArmor only restricts existing native Linux controls and does
not grant additional privileges. The only exception from this strict
rule is the set capability rule. For security reasons, set capability
rules will not be inherited. Once a program leaves the profile, it loses
the elevated privilege. Setting a capability also implicitly adds a
capability rule allowing that capability. Since this rule gives
processes root privileges, it should be used with extreme caution and
only in exceptional cases.
</p><pre class="screen">set capability cap_chown,</pre></div><div class="sect2" title="7.14. Hats"><div class="titlepage"><div><div><h3 class="title"><a name="sec.aaquick.profile_structure.hats"></a>7.14. Hats<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.profile_structure.hats">¶</a></span></h3></div></div></div><p>
An AppArmor profile represents a security policy for an individual program
instance or process. It applies to an executable program, but if a
portion of the program needs different access permissions than other
portions, the program can <span class="quote">“<span class="quote">change hats</span>”</span> to use a different
security context, distinctive from the access of the main program. This
is known as a hat or subprofile.
</p><p>
A profile can have an arbitrary number of hats, but there are only two
levels: a hat cannot have further hats.
</p><p>
The AppArmor ChangeHat feature can be used by applications to access hats
during execution. Currently the packages
<code class="systemitem">apache2-mod_apparmor</code> and
<code class="systemitem">tomcat_apparmor</code> utilize
ChangeHat to provide sub-process confinement for the Apache Web server
and the Tomcat servlet container.
</p></div></div><div class="sect1" title="8. Confining Users with pam_apparmor"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sec.aaquick.pam_apparmor"></a>8. Confining Users with pam_apparmor<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.pam_apparmor">¶</a></span></h2></div></div></div><p>
The pam_apparmor PAM module allows applications to confine authenticated
users into subprofiles based on group names, user names, or default
profile. To accomplish this, pam_apparmor needs to be registered as a PAM
session module.
</p><p>
Details about how to set up and configure pam_apparmor can be found in
<code class="filename">/usr/share/doc/packages/pam_apparmor/README</code>. A HOWTO
on setting up role-based access control (RBAC) with pam_apparmor is
available at
<a class="ulink" href="http://developer.novell.com/wiki/index.php/Apparmor_RBAC_in_version_2.3" target="_top">http://developer.novell.com/wiki/index.php/Apparmor_RBAC_in_version_2.3</a>.
</p></div><div class="sect1" title="9. Logging and Auditing"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sec.aaquick.audit"></a>9. Logging and Auditing<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.audit">¶</a></span></h2></div></div></div><p>
All AppArmor events are logged using the system's audit interface (the auditd
logging to <code class="filename">/var/log/audit/audit.log</code>). On top of this
infrastructure, event notification can be configured. Configure this
feature using YaST. It is based on severity levels according to
<code class="filename">/etc/apparmor/severity.db</code>. Notification frequency
and type of notification (such as e-mail) can be configured.
</p><p>
If auditd is not running, AppArmor logs to the system log located under
<code class="filename">/var/log/messages</code> using the <code class="envar">LOG_KERN</code>
facility.
</p><p>
Use YaST for generating reports in CSV or HTML format.
</p><p>
The Linux audit framework contains a dispatcher that can send AppArmor events
to any consumer application via dbus. The GNOME AppArmor Desktop Monitor
applet is one example of an application that gathers AppArmor events via
dbus. To configure audit to use the dbus dispatcher, set the dispatcher
in your audit configuration in
<code class="filename">/etc/audit/auditd.conf</code> to
<code class="literal">apparmor-dbus</code> and restart auditd:
</p><pre class="screen">dispatcher=/usr/bin/apparmor-dbus
</pre><p>
Once the dbus dispatcher is configured correctly, add the AppArmor Desktop
Monitor to the GNOME panel. As soon as a <code class="literal">REJECT</code> event
is logged, the applet's panel icon changes appearance and you can click
the applet to see the number of reject events per confined application.
To view the exact log messages, refer to the audit log under
<code class="filename">/var/log/audit/audit.log</code>. Use the YaST Update
Profile Wizard to adjust the respective profile.
</p></div><div class="sect1" title="10. Directories and Files"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sec.aaquick.directories_files"></a>10. Directories and Files<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#sec.aaquick.directories_files">¶</a></span></h2></div></div></div><div class="variablelist"><dl><dt><span class="term"><code class="filename">/sys/kernel/security/apparmor/profiles</code>
</span></dt><dd><p>
Virtualized file representing the currently loaded set of profiles.
</p></dd><dt><span class="term"><code class="filename">/etc/apparmor/</code>
</span></dt><dd><p>
Location of AppArmor configuration files.
</p></dd><dt><span class="term"><code class="filename">/etc/apparmor/profiles/extras/</code>
</span></dt><dd><p>
A local repository of profiles shipped with AppArmor, but not enabled by
default.
</p></dd><dt><span class="term"><code class="filename">/etc/apparmor.d/</code>
</span></dt><dd><p>
Location of profiles, named with the convention of replacing the
<code class="literal">/</code> in pathnames with <code class="literal">.</code> (not for
the root <code class="literal">/</code>) so profiles are easier to manage. For
example, the profile for the program
<code class="filename">/usr/sbin/ntpd</code> is named
<code class="filename">usr.sbin.ntpd</code>.
</p></dd><dt><span class="term"><code class="filename">/etc/apparmor.d/abstractions/</code>
</span></dt><dd><p>
Location of abstractions.
</p></dd><dt><span class="term"><code class="filename">/etc/apparmor.d/program-chunks/</code>
</span></dt><dd><p>
Location of program chunks.
</p></dd><dt><span class="term"><code class="filename">/proc/*/attr/current</code>
</span></dt><dd><p>
Review the confinement status of a process and the profile that is
used to confine the process. The <span class="command"><strong>ps
<code class="option">auxZ</code></strong></span> command retrieves this information
automatically.
</p></dd></dl></div></div><div class="sect1" title="11. For More Information"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id421846"></a>11. For More Information<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id421846">¶</a></span></h2></div></div></div><p>
To learn more about the AppArmor project, check out the project's home page
under <a class="ulink" href="http://en.opensuse.org/AppArmor" target="_top">http://en.opensuse.org/AppArmor</a>. Find more
information on the concept and the configuration of AppArmor in
Part “Confining Privileges with Novell AppArmor” (↑Security Guide).
</p></div><div class="sect1" title="12. Legal Notice"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id421874"></a>12. Legal Notice<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id421874">¶</a></span></h2></div></div></div><p>
Copyright© 2006–
2010
Novell, Inc. and contributors. All rights reserved.
</p><p>
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.2 or (at
your option) version 1.3; with the Invariant Section being this copyright
notice and license. A copy of the license version 1.2 is included in the
section entitled <span class="quote">“<span class="quote">GNU Free Documentation License</span>”</span>.
</p><p>
For Novell trademarks, see the Novell Trademark and Service Mark list
<a class="ulink" href="http://www.novell.com/company/legal/trademarks/tmlist.html" target="_top">http://www.novell.com/company/legal/trademarks/tmlist.html</a>.
Linux* is a registered trademark of Linus Torvalds. All other third party
trademarks are the property of their respective owners. A trademark symbol
(®, ™ etc.) denotes a Novell trademark; an asterisk (*) denotes
a third party trademark.
</p><p>
All information found in this book has been compiled with utmost attention
to detail. However, this does not guarantee complete accuracy. Neither
Novell, Inc., SUSE LINUX Products GmbH, the authors, nor the translators
shall be held liable for possible errors or the consequences thereof.
</p></div><div class="sect1" title="13. GNU Free Documentation License"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id421934"></a>13. GNU Free Documentation License<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id421934">¶</a></span></h2></div></div></div><p>
Version 1.2, November 2002
</p><p>
Copyright (C) 2000,2001,2002 Free Software Foundation, Inc. 59 Temple
Place, Suite 330, Boston, MA 02111-1307 USA
</p><p>
Everyone is permitted to copy and distribute verbatim copies of this
license document, but changing it is not allowed.
</p><div class="sect2" title="13.1. PREAMBLE"><div class="titlepage"><div><div><h3 class="title"><a name="id421958"></a>13.1. PREAMBLE<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id421958">¶</a></span></h3></div></div></div><p>
The purpose of this License is to make a manual, textbook, or other
functional and useful document “free” in the sense of
freedom: to assure everyone the effective freedom to copy and
redistribute it, with or without modifying it, either commercially or
noncommercially. Secondarily, this License preserves for the author and
publisher a way to get credit for their work, while not being considered
responsible for modifications made by others.
</p><p>
This License is a kind of <span class="quote">“<span class="quote">copyleft</span>”</span>, which means that
derivative works of the document must themselves be free in the same
sense. It complements the GNU General Public License, which is a copyleft
license designed for free software.
</p><p>
We have designed this License in order to use it for manuals for free
software, because free software needs free documentation: a free program
should come with manuals providing the same freedoms that the software
does. But this License is not limited to software manuals; it can be used
for any textual work, regardless of subject matter or whether it is
published as a printed book. We recommend this License principally for
works whose purpose is instruction or reference.
</p></div><div class="sect2" title="13.2. APPLICABILITY AND DEFINITIONS"><div class="titlepage"><div><div><h3 class="title"><a name="id421990"></a>13.2. APPLICABILITY AND DEFINITIONS<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id421990">¶</a></span></h3></div></div></div><p>
This License applies to any manual or other work, in any medium, that
contains a notice placed by the copyright holder saying it can be
distributed under the terms of this License. Such a notice grants a
world-wide, royalty-free license, unlimited in duration, to use that work
under the conditions stated herein. The <span class="quote">“<span class="quote">Document</span>”</span>, below,
refers to any such manual or work. Any member of the public is a
licensee, and is addressed as <span class="quote">“<span class="quote">you</span>”</span>. You accept the license
if you copy, modify or distribute the work in a way requiring permission
under copyright law.
</p><p>
A <span class="quote">“<span class="quote">Modified Version</span>”</span> of the Document means any work
containing the Document or a portion of it, either copied verbatim, or
with modifications and/or translated into another language.
</p><p>
A <span class="quote">“<span class="quote">Secondary Section</span>”</span> is a named appendix or a front-matter
section of the Document that deals exclusively with the relationship of
the publishers or authors of the Document to the Document’s overall
subject (or to related matters) and contains nothing that could fall
directly within that overall subject. (Thus, if the Document is in part a
textbook of mathematics, a Secondary Section may not explain any
mathematics.) The relationship could be a matter of historical connection
with the subject or with related matters, or of legal, commercial,
philosophical, ethical or political position regarding them.
</p><p>
The <span class="quote">“<span class="quote">Invariant Sections</span>”</span> are certain Secondary Sections
whose titles are designated, as being those of Invariant Sections, in the
notice that says that the Document is released under this License. If a
section does not fit the above definition of Secondary then it is not
allowed to be designated as Invariant. The Document may contain zero
Invariant Sections. If the Document does not identify any Invariant
Sections then there are none.
</p><p>
The <span class="quote">“<span class="quote">Cover Texts</span>”</span> are certain short passages of text that
are listed, as Front-Cover Texts or Back-Cover Texts, in the notice that
says that the Document is released under this License. A Front-Cover Text
may be at most 5 words, and a Back-Cover Text may be at most 25 words.
</p><p>
A <span class="quote">“<span class="quote">Transparent</span>”</span> copy of the Document means a
machine-readable copy, represented in a format whose specification is
available to the general public, that is suitable for revising the
document straightforwardly with generic text editors or (for images
composed of pixels) generic paint programs or (for drawings) some widely
available drawing editor, and that is suitable for input to text
formatters or for automatic translation to a variety of formats suitable
for input to text formatters. A copy made in an otherwise Transparent
file format whose markup, or absence of markup, has been arranged to
thwart or discourage subsequent modification by readers is not
Transparent. An image format is not Transparent if used for any
substantial amount of text. A copy that is not <span class="quote">“<span class="quote">Transparent</span>”</span>
is called <span class="quote">“<span class="quote">Opaque</span>”</span>.
</p><p>
Examples of suitable formats for Transparent copies include plain ASCII
without markup, Texinfo input format, LaTeX input format, SGML or XML
using a publicly available DTD, and standard-conforming simple HTML,
PostScript or PDF designed for human modification. Examples of
transparent image formats include PNG, XCF and JPG. Opaque formats
include proprietary formats that can be read and edited only by
proprietary word processors, SGML or XML for which the DTD and/or
processing tools are not generally available, and the machine-generated
HTML, PostScript or PDF produced by some word processors for output
purposes only.
</p><p>
The <span class="quote">“<span class="quote">Title Page</span>”</span> means, for a printed book, the title page
itself, plus such following pages as are needed to hold, legibly, the
material this License requires to appear in the title page. For works in
formats which do not have any title page as such, <span class="quote">“<span class="quote">Title
Page</span>”</span> means the text near the most prominent appearance of the
work’s title, preceding the beginning of the body of the text.
</p><p>
A section <span class="quote">“<span class="quote">Entitled XYZ</span>”</span> means a named subunit of the
Document whose title either is precisely XYZ or contains XYZ in
parentheses following text that translates XYZ in another language. (Here
XYZ stands for a specific section name mentioned below, such as
<span class="quote">“<span class="quote">Acknowledgements</span>”</span>, <span class="quote">“<span class="quote">Dedications</span>”</span>,
<span class="quote">“<span class="quote">Endorsements</span>”</span>, or <span class="quote">“<span class="quote">History</span>”</span>.) To
<span class="quote">“<span class="quote">Preserve the Title</span>”</span> of such a section when you modify the
Document means that it remains a section <span class="quote">“<span class="quote">Entitled XYZ</span>”</span>
according to this definition.
</p><p>
The Document may include Warranty Disclaimers next to the notice which
states that this License applies to the Document. These Warranty
Disclaimers are considered to be included by reference in this License,
but only as regards disclaiming warranties: any other implication that
these Warranty Disclaimers may have is void and has no effect on the
meaning of this License.
</p></div><div class="sect2" title="13.3. VERBATIM COPYING"><div class="titlepage"><div><div><h3 class="title"><a name="id427698"></a>13.3. VERBATIM COPYING<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id427698">¶</a></span></h3></div></div></div><p>
You may copy and distribute the Document in any medium, either
commercially or noncommercially, provided that this License, the
copyright notices, and the license notice saying this License applies to
the Document are reproduced in all copies, and that you add no other
conditions whatsoever to those of this License. You may not use technical
measures to obstruct or control the reading or further copying of the
copies you make or distribute. However, you may accept compensation in
exchange for copies. If you distribute a large enough number of copies
you must also follow the conditions in section 3.
</p><p>
You may also lend copies, under the same conditions stated above, and you
may publicly display copies.
</p></div><div class="sect2" title="13.4. COPYING IN QUANTITY"><div class="titlepage"><div><div><h3 class="title"><a name="id427719"></a>13.4. COPYING IN QUANTITY<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id427719">¶</a></span></h3></div></div></div><p>
If you publish printed copies (or copies in media that commonly have
printed covers) of the Document, numbering more than 100, and the
Document’s license notice requires Cover Texts, you must enclose
the copies in covers that carry, clearly and legibly, all these Cover
Texts: Front-Cover Texts on the front cover, and Back-Cover Texts on the
back cover. Both covers must also clearly and legibly identify you as the
publisher of these copies. The front cover must present the full title
with all words of the title equally prominent and visible. You may add
other material on the covers in addition. Copying with changes limited to
the covers, as long as they preserve the title of the Document and
satisfy these conditions, can be treated as verbatim copying in other
respects.
</p><p>
If the required texts for either cover are too voluminous to fit legibly,
you should put the first ones listed (as many as fit reasonably) on the
actual cover, and continue the rest onto adjacent pages.
</p><p>
If you publish or distribute Opaque copies of the Document numbering more
than 100, you must either include a machine-readable Transparent copy
along with each Opaque copy, or state in or with each Opaque copy a
computer-network location from which the general network-using public has
access to download using public-standard network protocols a complete
Transparent copy of the Document, free of added material. If you use the
latter option, you must take reasonably prudent steps, when you begin
distribution of Opaque copies in quantity, to ensure that this
Transparent copy will remain thus accessible at the stated location until
at least one year after the last time you distribute an Opaque copy
(directly or through your agents or retailers) of that edition to the
public.
</p><p>
It is requested, but not required, that you contact the authors of the
Document well before redistributing any large number of copies, to give
them a chance to provide you with an updated version of the Document.
</p></div><div class="sect2" title="13.5. MODIFICATIONS"><div class="titlepage"><div><div><h3 class="title"><a name="id427758"></a>13.5. MODIFICATIONS<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id427758">¶</a></span></h3></div></div></div><p>
You may copy and distribute a Modified Version of the Document under the
conditions of sections 2 and 3 above, provided that you release the
Modified Version under precisely this License, with the Modified Version
filling the role of the Document, thus licensing distribution and
modification of the Modified Version to whoever possesses a copy of it.
In addition, you must do these things in the Modified Version:
</p><p title="A."><b>A. </b>
Use in the Title Page (and on the covers, if any) a title distinct from
that of the Document, and from those of previous versions (which should,
if there were any, be listed in the History section of the Document).
You may use the same title as a previous version if the original
publisher of that version gives permission.
</p><p title="B."><b>B. </b>
List on the Title Page, as authors, one or more persons or entities
responsible for authorship of the modifications in the Modified Version,
together with at least five of the principal authors of the Document
(all of its principal authors, if it has fewer than five), unless they
release you from this requirement.
</p><p title="C."><b>C. </b>
State on the Title page the name of the publisher of the Modified
Version, as the publisher.
</p><p title="D."><b>D. </b>
Preserve all the copyright notices of the Document.
</p><p title="E."><b>E. </b>
Add an appropriate copyright notice for your modifications adjacent to
the other copyright notices.
</p><p title="F."><b>F. </b>
Include, immediately after the copyright notices, a license notice
giving the public permission to use the Modified Version under the terms
of this License, in the form shown in the Addendum below.
</p><p title="G."><b>G. </b>
Preserve in that license notice the full lists of Invariant Sections and
required Cover Texts given in the Document’s license notice.
</p><p title="H."><b>H. </b>
Include an unaltered copy of this License.
</p><p title="I."><b>I. </b>
Preserve the section Entitled <span class="quote">“<span class="quote">History</span>”</span>, Preserve its
Title, and add to it an item stating at least the title, year, new
authors, and publisher of the Modified Version as given on the Title
Page. If there is no section Entitled <span class="quote">“<span class="quote">History</span>”</span> in the
Document, create one stating the title, year, authors, and publisher of
the Document as given on its Title Page, then add an item describing the
Modified Version as stated in the previous sentence.
</p><p title="J."><b>J. </b>
Preserve the network location, if any, given in the Document for public
access to a Transparent copy of the Document, and likewise the network
locations given in the Document for previous versions it was based on.
These may be placed in the <span class="quote">“<span class="quote">History</span>”</span> section. You may omit
a network location for a work that was published at least four years
before the Document itself, or if the original publisher of the version
it refers to gives permission.
</p><p title="K."><b>K. </b>
For any section Entitled <span class="quote">“<span class="quote">Acknowledgements</span>”</span> or
<span class="quote">“<span class="quote">Dedications</span>”</span>, Preserve the Title of the section, and
preserve in the section all the substance and tone of each of the
contributor acknowledgements and/or dedications given therein.
</p><p title="L."><b>L. </b>
Preserve all the Invariant Sections of the Document, unaltered in their
text and in their titles. Section numbers or the equivalent are not
considered part of the section titles.
</p><p title="M."><b>M. </b>
Delete any section Entitled <span class="quote">“<span class="quote">Endorsements</span>”</span>. Such a section
may not be included in the Modified Version.
</p><p title="N."><b>N. </b>
Do not retitle any existing section to be Entitled
<span class="quote">“<span class="quote">Endorsements</span>”</span> or to conflict in title with any Invariant
Section.
</p><p title="O."><b>O. </b>
Preserve any Warranty Disclaimers.
</p><p>
If the Modified Version includes new front-matter sections or appendices
that qualify as Secondary Sections and contain no material copied from
the Document, you may at your option designate some or all of these
sections as invariant. To do this, add their titles to the list of
Invariant Sections in the Modified Version’s license notice. These
titles must be distinct from any other section titles.
</p><p>
You may add a section Entitled <span class="quote">“<span class="quote">Endorsements</span>”</span>, provided it
contains nothing but endorsements of your Modified Version by various
parties--for example, statements of peer review or that the text has been
approved by an organization as the authoritative definition of a
standard.
</p><p>
You may add a passage of up to five words as a Front-Cover Text, and a
passage of up to 25 words as a Back-Cover Text, to the end of the list of
Cover Texts in the Modified Version. Only one passage of Front-Cover Text
and one of Back-Cover Text may be added by (or through arrangements made
by) any one entity. If the Document already includes a cover text for the
same cover, previously added by you or by arrangement made by the same
entity you are acting on behalf of, you may not add another; but you may
replace the old one, on explicit permission from the previous publisher
that added the old one.
</p><p>
The author(s) and publisher(s) of the Document do not by this License
give permission to use their names for publicity for or to assert or
imply endorsement of any Modified Version.
</p></div><div class="sect2" title="13.6. COMBINING DOCUMENTS"><div class="titlepage"><div><div><h3 class="title"><a name="id419385"></a>13.6. COMBINING DOCUMENTS<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id419385">¶</a></span></h3></div></div></div><p>
You may combine the Document with other documents released under this
License, under the terms defined in section 4 above for modified
versions, provided that you include in the combination all of the
Invariant Sections of all of the original documents, unmodified, and list
them all as Invariant Sections of your combined work in its license
notice, and that you preserve all their Warranty Disclaimers.
</p><p>
The combined work need only contain one copy of this License, and
multiple identical Invariant Sections may be replaced with a single copy.
If there are multiple Invariant Sections with the same name but different
contents, make the title of each such section unique by adding at the end
of it, in parentheses, the name of the original author or publisher of
that section if known, or else a unique number. Make the same adjustment
to the section titles in the list of Invariant Sections in the license
notice of the combined work.
</p><p>
In the combination, you must combine any sections Entitled
<span class="quote">“<span class="quote">History</span>”</span> in the various original documents, forming one
section Entitled <span class="quote">“<span class="quote">History</span>”</span>; likewise combine any sections
Entitled <span class="quote">“<span class="quote">Acknowledgements</span>”</span>, and any sections Entitled
<span class="quote">“<span class="quote">Dedications</span>”</span>. You must delete all sections Entitled
<span class="quote">“<span class="quote">Endorsements</span>”</span>.
</p></div><div class="sect2" title="13.7. COLLECTIONS OF DOCUMENTS"><div class="titlepage"><div><div><h3 class="title"><a name="id419429"></a>13.7. COLLECTIONS OF DOCUMENTS<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id419429">¶</a></span></h3></div></div></div><p>
You may make a collection consisting of the Document and other documents
released under this License, and replace the individual copies of this
License in the various documents with a single copy that is included in
the collection, provided that you follow the rules of this License for
verbatim copying of each of the documents in all other respects.
</p><p>
You may extract a single document from such a collection, and distribute
it individually under this License, provided you insert a copy of this
License into the extracted document, and follow this License in all other
respects regarding verbatim copying of that document.
</p></div><div class="sect2" title="13.8. AGGREGATION WITH INDEPENDENT WORKS"><div class="titlepage"><div><div><h3 class="title"><a name="id419449"></a>13.8. AGGREGATION WITH INDEPENDENT WORKS<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id419449">¶</a></span></h3></div></div></div><p>
A compilation of the Document or its derivatives with other separate and
independent documents or works, in or on a volume of a storage or
distribution medium, is called an “aggregate” if the
copyright resulting from the compilation is not used to limit the legal
rights of the compilation’s users beyond what the individual works
permit. When the Document is included in an aggregate, this License does
not apply to the other works in the aggregate which are not themselves
derivative works of the Document.
</p><p>
If the Cover Text requirement of section 3 is applicable to these copies
of the Document, then if the Document is less than one half of the entire
aggregate, the Document’s Cover Texts may be placed on covers that
bracket the Document within the aggregate, or the electronic equivalent
of covers if the Document is in electronic form. Otherwise they must
appear on printed covers that bracket the whole aggregate.
</p></div><div class="sect2" title="13.9. TRANSLATION"><div class="titlepage"><div><div><h3 class="title"><a name="id419472"></a>13.9. TRANSLATION<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id419472">¶</a></span></h3></div></div></div><p>
Translation is considered a kind of modification, so you may distribute
translations of the Document under the terms of section 4. Replacing
Invariant Sections with translations requires special permission from
their copyright holders, but you may include translations of some or all
Invariant Sections in addition to the original versions of these
Invariant Sections. You may include a translation of this License, and
all the license notices in the Document, and any Warranty Disclaimers,
provided that you also include the original English version of this
License and the original versions of those notices and disclaimers. In
case of a disagreement between the translation and the original version
of this License or a notice or disclaimer, the original version will
prevail.
</p><p>
If a section in the Document is Entitled <span class="quote">“<span class="quote">Acknowledgements</span>”</span>,
<span class="quote">“<span class="quote">Dedications</span>”</span>, or <span class="quote">“<span class="quote">History</span>”</span>, the requirement
(section 4) to Preserve its Title (section 1) will typically require
changing the actual title.
</p></div><div class="sect2" title="13.10. TERMINATION"><div class="titlepage"><div><div><h3 class="title"><a name="id419506"></a>13.10. TERMINATION<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id419506">¶</a></span></h3></div></div></div><p>
You may not copy, modify, sublicense, or distribute the Document except
as expressly provided for under this License. Any other attempt to copy,
modify, sublicense or distribute the Document is void, and will
automatically terminate your rights under this License. However, parties
who have received copies, or rights, from you under this License will not
have their licenses terminated so long as such parties remain in full
compliance.
</p></div><div class="sect2" title="13.11. FUTURE REVISIONS OF THIS LICENSE"><div class="titlepage"><div><div><h3 class="title"><a name="id419521"></a>13.11. FUTURE REVISIONS OF THIS LICENSE<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id419521">¶</a></span></h3></div></div></div><p>
The Free Software Foundation may publish new, revised versions of the GNU
Free Documentation License from time to time. Such new versions will be
similar in spirit to the present version, but may differ in detail to
address new problems or concerns. See
http://www.gnu.org/copyleft/.
</p><p>
Each version of the License is given a distinguishing version number. If
the Document specifies that a particular numbered version of this License
<span class="quote">“<span class="quote">or any later version</span>”</span> applies to it, you have the option of
following the terms and conditions either of that specified version or of
any later version that has been published (not as a draft) by the Free
Software Foundation. If the Document does not specify a version number of
this License, you may choose any version ever published (not as a draft)
by the Free Software Foundation.
</p></div><div class="sect2" title="13.12. ADDENDUM: How to use this License for your documents"><div class="titlepage"><div><div><h3 class="title"><a name="id419546"></a>13.12. ADDENDUM: How to use this License for your documents<span class="permalink"><a alt="Permalink" title="Copy Permalink" href="#id419546">¶</a></span></h3></div></div></div><p>
To use this License in a document you have written, include a copy of the
License in the document and put the following copyright and license
notices just after the title page:
</p><pre class="screen">
Copyright (c) YEAR YOUR NAME.
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.2
or any later version published by the Free Software Foundation;
with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
A copy of the license is included in the section entitled “GNU
Free Documentation License”.
</pre><p>
If you have Invariant Sections, Front-Cover Texts and Back-Cover Texts,
replace the “with...Texts.” line with this:
</p><pre class="screen">
with the Invariant Sections being LIST THEIR TITLES, with the
Front-Cover Texts being LIST, and with the Back-Cover Texts being LIST.
</pre><p>
If you have Invariant Sections without Cover Texts, or some other
combination of the three, merge those two alternatives to suit the
situation.
</p><p>
If your document contains nontrivial examples of program code, we
recommend releasing these examples in parallel under your choice of free
software license, such as the GNU General Public License, to permit their
use in free software.
</p></div></div></div><div class="navfooter"><table width="100%" summary="Navigation footer" border="0" class="bctable"><tr><td width="80%"><div class="breadcrumbs"><p><a href="index.html"> Documentation</a><span class="breadcrumbs-sep"> > </span><a href="book.quickstarts.html">Quick Start Manuals</a><span class="breadcrumbs-sep"> > </span><strong><a accesskey="p" title="GNOME Quick Start" href="art.gnomequick.html"><span>◀</span></a> <a accesskey="n" title="Legal Information" href="bk07ar05.html"><span>▶</span></a></strong></p></div></td></tr></table></div></body></html>
ACC SHELL 2018