mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update profileflags

John Johansen 2023-08-11 02:30:27 +00:00
parent d709767367
commit f766779bf2
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
profileflags.md

@ -16,20 +16,20 @@ If no mode is specified the profile defaults to ```enforce``` mode.
code returned to userspace, and the violation will be logged with a tag
of the access being DENIED.
* **kill** (**new AppArmor 4.0**) - This is a variant of enforce mode where in addition to
* **kill** (**new** AppArmor 4.0) - This is a variant of enforce mode where in addition to
returning _EACCES_ or _EPERM_ for a violation, the task is also sent
a signal to kill it.
* **complain** (**new AppArmor 4.0**) - For a given action, if the profile rules do not grant
* **complain** - For a given action, if the profile rules do not grant
permission the action will be allowed, but the violation will be logged
with a tag of the access being ALLOWED.
* **prompt** (**new AppArmor 4.0**) - This is a variant of complain mode where the access request
* **prompt** (**new** AppArmor 4.0) - This is a variant of complain mode where the access request
is sent to a user space daemon to determine if it is allowed. This only works with select
rules and only if supported by the kernel. If the usespace daemon is not present the
access request will be denied.
* **unconfined** (**new AppArmor 4.0**) - This mode allows a task confined by the profile to
* **unconfined** (**new** AppArmor 4.0) - This mode allows a task confined by the profile to
behave as though they are I<unconfined>. This mode allow for an
unconfined behavior that can be later changed to confinement by using
profile replacement. This mode is should not be used under regular