In this lesson, you will learn how to use advanced globbing patterns to define precise, flexible security rules for applications that generate logs or data in unpredictable directory structures.
Understanding Dynamic Path Globbing
When applications create files with timestamps or process IDs in their names—such as /var/log/app/2023-10-27/process-552/data.log—hardcoding every possible path into a security policy is impossible. AppArmor allows you to use globbing to match patterns rather than static strings, ensuring that dynamic content remains restricted without breaking application functionality.
The Syntax of Advanced Patterns
Beyond simple wildcards, AppArmor supports specific syntax to handle complex paths:
*: Matches any character except the directory separator (/). This is ideal for single-level files (e.g.,/var/log/app/*.log).**: Matches any character, including the directory separator. This is a powerful, recursive wildcard that can span multiple subdirectories.?: Matches exactly one character, which is useful when dealing with specific versioning schemes (e.g.,/usr/lib/app-v?.0/).
Consider a scenario where an application writes temporary data into a date-stamped directory structure:
# Allow access to logs in any date-stamped subdirectory
/var/log/myapp/[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]/*.log r,
# Allow recursive access to a dynamic workspace directory
/var/lib/myapp/workspace/** rw,
Strategic Implementation
When using **, be careful: it is highly permissive. If you define a rule like /var/lib/myapp/** rw,, you are granting the application authority over every nested file and folder. To maintain a strong security posture, try to anchor your globbing as specifically as possible. Use character classes like [0-9] for numerical timestamps or [a-z] for version identifiers to limit the scope of the rule while still providing the flexibility required by your dynamic application architecture. By tightening the pattern, you prevent unauthorized access to sensitive files that might accidentally share the same parent directory.
Key Takeaway: Use the * wildcard for single-level file matching and the ** recursive wildcard for multi-level directory traversal, while anchoring your glob patterns with specific character sets to ensure the principle of least privilege.