1.3 Immunizing Cron Jobs
To find programs that are run by cron, inspect your local cron configuration. Unfortu-
nately, cron configuration is rather complex, so there are numerous files to inspect.
Periodic cron jobs are run from these files:
/etc/crontab
/etc/cron.d/*
/etc/cron.daily/*
/etc/cron.hourly/*
/etc/cron.monthly/*
/etc/cron.weekly/*
For
root
's cron jobs, edit the tasks with
crontab -e
and list
root
's cron tasks
with
crontab -l
. You must be
root
for these to work.
Once you find these programs, you can use the Add Profile Wizard to create profiles
for them. Refer to
Section 3.1, “Adding a Profile Using the Wizard”
(page 25).
1.4 Immunizing Network Applications
An automated method for finding network server daemons that should be profiled is to
use the aa-unconfined tool. You can also simply view a report of this information in
the YaST module (refer to
Section “Application Audit Report”
(page 97) for instruc-
tions).
The aa-unconfined tool uses the command
netstat -nlp
to inspect your open ports
from inside your computer, detect the programs associated with those ports, and inspect
the set of Novell AppArmor profiles that you have loaded. aa-unconfined then reports
these programs along with the Novell AppArmor profile associated with each program
or reports “none” if the program is not confined.
NOTE
If you create a new profile, you must restart the program that has been profiled
to have it be effectively confined by AppArmor.
Immunizing Programs
13
