Novell APPARMOR 1.2, Administration Manual, Page: 61 / 130

tools can consistently manipulate them. The convention is to replace
a forward slash (
/
) with period (
.
) so that the profile for
/usr/
sbin/httpd2-prefork
is stored in
/etc/subdomain.d/usr
.sbin.httpd2-prefork
.
• Puts the profile for this program into learning or complain mode so that
profile violations are logged but are permitted to proceed. A log event looks
like this:
Oct 9 15:40:31 SubDomain: PERMITTING r access to
/etc/apache2/httpd.conf (httpd2-prefork(6068) profile
/usr/sbin/httpd2-prefork active /usr/sbin/httpd2-prefork)
• Marks syslog with a beginning marker of log events to consider. Example:
Sep 13 17:48:52 h2o root: GenProf: e2ff78636296f16d0b5301209a04430d
3 When prompted by the tool, run the application to profile in another terminal
window and perform as many of the application functions as possible so learning
mode can log the files and directories to which the program requires access in
order to function properly. For example, in a new terminal window, enter
rcapache2 start
.
4 Select from the following options, which can be used after you have executed
the program functionality:
•
S
runs logprof against the system log from where it was marked when gen-
prof was started and reloads the profile.
If system events exist in the log, Novell AppArmor parses the learning mode
log files. This generates a series of questions that you must answer to guide
genprof in generating the security profile.
•
F
exits the tool and returns to the main menu.
NOTE
If requests to add hats appear, proceed to Chapter 5, Profiling Your Web
Applications Using ChangeHat Apache (page 105).
Building Novell AppArmor Profiles 61