Novell APPARMOR 1.2, Administration Manual, Page: 17 / 130

4373 /usr/lib/postfix/master confined by '/usr/lib/postfix/master (enforce)'
4505 /usr/sbin/httpd2-prefork confined by '/usr/sbin/httpd2-prefork (enforce)'
5274 /sbin/dhcpcd not confined
5592 /usr/bin/ssh not confined
7146 /usr/sbin/cupsd confined by '/usr/sbin/cupsd (complain)'
❶ The first portion is a number. This number is the process ID number (PID) of the
listening program.
❷ The second portion is a string that represents the absolute path of the listening
program
❸ The final portion indicates the profile confining the program, if any.
NOTE
Unconfined requires root privileges and should not be run from a shell that is
confined by an AppArmor profile.
Unconfined does not distinguish between one network interface and another, so it reports
all unconfined processes, even those that might be listening to an internal LAN interface.
Finding user network client applications is dependent on your user preferences. The
unconfined tool detects and reports network ports opened by client applications, but
only those client applications that are running at the time the unconfined analysis is
performed. This is a problem because network services tend to be running all the time,
while network client applications tend only to be running when the user is interested
in them.
Applying Novell AppArmor profiles to user network client applications is also dependent
on user preferences, and Novell AppArmor is intended for servers rather than worksta-
tions. Therefore, we leave profiling of user network client applications as an exercise
for the user.
To aggressively confine desktop applications, the unconfined command supports a
paranoid option, which reports all processes running and the corresponding AppArmor
profiles that might or might not be associated with each process. The unconfined user
can then decide whether each of these programs needs an AppArmor profile.
Additional profiles can be traded with other users and with the Novell® security devel-
opment team on the user mailing list at
http://mail.wirex.com/mailman/
listinfo/immunix-users
.
Selecting Programs to Immunize 17