Novell APPARMOR 1.2, Administration Manual, Page: 59 / 130

Each of the above commands activates the complain mode for the profiles/programs
listed. The command can list either programs or profiles. If the program name does not
include its entire path, then complain searches
$PATH
for the program. So, for instance,
complain /usr/sbin/*
finds profiles associated with all of the programs in
/usr/sbin
and put them into complain mode, and
complain
/etc/subdomain.d/*
puts all of the profiles in
/etc/subdomain.d
into
complain mode.
Enforce Mode
The enforce mode tool detects violations of Novell AppArmor profile rules, such as
the profiled program accessing files not permitted by the profile. The violations are
logged and not permitted. The default is for enforce mode to be turned on. Turn complain
mode on when you want the Novell AppArmor profiles to control the access of the
program that is profiled. Enforce toggles with complain mode.
Manually activating enforce mode (using the command line) adds a flag to the top of
the profile so that
/bin/foo
becomes
/bin/foo flags=(enforce)
. To use
enforce mode, open a terminal window and enter one of the following lines as a root
user.
• If the example program (
program1
) is in your path, use:
enforce [ program1 program2 ...]
• If the program is not in your path, specify the entire path, as follows:
enforce /sbin/ program1
• If the profiles are not in
/etc/subdomain.d
, use the following to override the
default location:
enforce /path/to/profiles/program1
• Specify the profile for
program1
, as follows:
enforce /etc/subdomain.d/sbin. program1
Each of the above commands activates the enforce mode for the profiles and programs
listed.
Building Novell AppArmor Profiles 59