Novell APPARMOR 1.2, Administration Manual, Page: 66 / 130

When logprof exits, profiles are updated with the changes. If the SubDomain module
is running, the updated profiles are reloaded and if any processes that generated security
events are still running in the null-complain-profile, those processes are set to run under
their proper profiles.
To run logprof, enter
logprof
into a terminal window while logged in as root. The
following options can also be used for logprof:
logprof -d /path/to/profile/directory/
Specifies the full path to the location of the profiles if the profiles are not located
in the standard directory,
/etc/subdomain.d/
.
logprof -f /path/to/logfile/
Specifies the full path to the location of the log file if the log file is not located in
the default directory,
/var/log/messages
.
logprof -m "string marker in logfile"
Marks the starting point for logprof to look in the system log. logprof ignores all
events in the system log before the specified mark is seen. If the mark contains
spaces, it must be surrounded with quotes to work correctly. Example:
logprof
-m e2ff78636296f16d0b5301209a04430d
logprof scans the log, asking you how to handle each logged event. Each question
presents a numbered list of Novell AppArmor rules that can be added by pressing the
number of the item on the list.
By default, logprof looks for profiles in
/etc/subdomain.d/
and scans the log in
/var/log/messages
so, in many cases, running
logprof
as root is enough to
create the profile.
However, there might times when you need to search archived log files, such as if the
program exercise period exceeds the log rotation window (when the log file is archived
and a new log file is started). If this is the case, you can enter
zcat -f `ls -1tr
/var/log/messages*` | logprof -f -
.
logprof Example 1
Following is an example of how logprof addresses httpd2-prefork accessing the file
/etc/group
. The example uses
[]
to indicate the default option.
66