AppArmor allows mediation of network access based on the address type and family. The following illustrates the network access rule syntax:
network [[<domain>][<type>][<protocol>]]
Supported domains: | |
Supported types: | |
Supported protocols: |
The AppArmor tools support only family and type specification. The AppArmor
module emits only network
in “access denied”
messages. And only these are output by the profile generation tools, both
YaST and command line.
domain
type
The following examples illustrate possible network-related rules to be used in AppArmor profiles. Note that the syntax of the last two are not currently supported by the AppArmor tools.
network, network inet, network inet6, network inet stream, network inet tcp, network tcp,
Allow all networking. No restrictions applied with regards to domain, type, or protocol. | |
Allow general use of IPv4 networking. | |
Allow general use of IPv6 networking. | |
Allow the use of IPv4 TCP networking. | |
Allow the use of IPv4 TCP networking, paraphrasing the rule above. | |
Allow the use of both IPv4 and IPv6 TCP networking. |