aa-logprof -m"17:04:21"
or
logprof -m e2ff78636296f16d0b5301209a04430d
aa-logprof scans the log, asking you how to handle each logged event. Each question
presents a numbered list of AppArmor rules that can be added by pressing the number
of the item on the list.
By default, aa-logprof looks for profiles in
/etc/apparmor.d/
and scans the log
in
/var/log/messages
. In many cases, running
aa-logprof
as
root
is enough
to create the profile.
However, there might be times when you need to search archived log files, such as if
the program exercise period exceeds the log rotation window (when the log file is
archived and a new log file is started). If this is the case, you can enter
zcat -f `ls
-1tr /var/log/messages*` | aa-logprof -f -
.
aa-logprof Example 1
The following is an example of how aa-logprof addresses httpd2-prefork accessing the
file
/etc/group
.
[]
indicates the default option.
In this example, the access to
/etc/group
is part of httpd2-prefork accessing name
services. The appropriate response is
1
, which includes a predefined set of AppArmor
rules. Selecting
1
to
#include
the name service package resolves all of the future
questions pertaining to DNS lookups and also makes the profile less brittle in that any
changes to DNS configuration and the associated name service profile package can be
made just once, rather than needing to revise many profiles.
Profile: /usr/sbin/httpd2-prefork
Path: /etc/group
New Mode: r
[1 - #include <abstractions/nameservice>]
2 - /etc/group
[(A)llow] / (D)eny / (N)ew / (G)lob / Glob w/(E)xt / Abo(r)t / (F)inish
Select one of the following responses:
Building Profiles from the Command Line
69
