archived and a new log file is started). If this is the case, you can enter
zcat -f `ls
-1tr /var/log/messages*` | aa-logprof -f -
.
aa-logprof Example 1
The following is an example of how aa-logprof addresses httpd2-prefork accessing the
file
/etc/group
.
[]
indicates the default option.
In this example, the access to
/etc/group
is part of httpd2-prefork accessing name
services. The appropriate response is
1
, which includes a predefined set of Novell
AppArmor rules. Selecting
1
to
#include
the name service package resolves all of
the future questions pertaining to DNS lookups and also makes the profile less brittle
in that any changes to DNS configuration and the associated name service profile
package can be made just once, rather than needing to revise many profiles.
Profile: /usr/sbin/httpd2-prefork
Path: /etc/group
New Mode: r
[1 - #include <abstractions/nameservice>]
2 - /etc/group
[(A)llow] / (D)eny / (N)ew / (G)lob / Glob w/(E)xt / Abo(r)t / (F)inish
Select one of the following responses:
Select
Enter
Allows access to the selected directory path.
Allow
Allows access to the specified directory path entries. Novell AppArmor suggests
file permission access. For more information about this, refer to
Section 4.8, “File
Permission Access Modes”
(page 69).
Deny
Prevents the program from accessing the specified directory path entries. Novell
AppArmor then moves on to the next event.
New
Prompts you to enter your own rule for this event, allowing you to specify whatever
form of regular expression you want. If the expression you enter does not actually
satisfy the event that prompted the question in the first place, Novell AppArmor
asks you for confirmation and lets you reenter the expression.
Building Profiles via the Command Line
63
