PID
A number that uniquely identifies one specific process or running program (this
number is valid only during the lifetime of that process).
State
This field reveals whether the program listed in the program field is confined. If it
is not confined, you might consider creating a profile for it.
Type
This field reveals the type of confinement the security event represents. It says either
complain or enforce. If the application is not confined (state), no type of confinement
is reported.
Security Incident Report
A security incident report displays security events of interest to an administrator. The
SIR reports policy violations for locally confined applications during the specified time
period. It also reports policy exceptions and policy engine state changes. These two
types of security events are defined as follows:
Policy Exceptions
When an application requests a resource that is not defined within its profile, a se-
curity event is triggered. A report is generated that displays security events of interest
to an administrator. The SIR reports policy violations for locally confined applica-
tions during the specified time period. The SIR reports policy exceptions and policy
engine state changes.
Policy Engine State Changes
Enforces policy for applications and maintains its own state, including when engines
start or stop, when a policy is reloaded, and when global security feature are enabled
or disabled.
98
Novell AppArmor Administration Guide