Creating a rule for a hexadecimal character code

[curiosityseeker]

I'm preparing a profile for scx-manager.

aa-log -r reports:

owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/app-org.cachyos.scx\x2dmanager@@{hex32}.service/cpu.max r,

and aa-log -R:

apparmor="ALLOWED" operation="open" class="file" profile="scx-manager" name="/sys/fs/cgroup/user.slice/user-1000.slice/[email protected]/app.slice/app-org.cachyos.scx\[email protected]/cpu.max" comm="scx-manager" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000 ...

Adding the rule suggested by aa-log -r is not successful. I know that the hexadecimal escape code \x2d correspondents to the ASCII character hypen-minus, i.e. -. But replacing \x2d with - does not solve the problem. Any ideas?

[roddhjav]

You cannot be specific here because the name of the cgroup depends on how the program was started. So something like the following is the max you can do:

owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*.service/cpu.max r,

This should be covered by the cgroup-limits abs.

[curiosityseeker]

Yes, I'm aware of the abs. This was meant as a general question how to handle such an occurrence.

Thank you for the guidance!

[curiosityseeker]

Actually, that case is not covered by the cgroup-limits abs as it only contains

owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r,

So should

owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*.service/cpu.max r,

be added as well?

And what about cases like:

owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/xdg-desktop-portal.service/memory.max r,
      @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/session-@{word}.scope/memory.max r,
owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*-@{int}.scope/memory.max r,

The last 2 ones are in abstractions/common/electron