Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 247 / 450

NOTE
aa-unconfined
requires
root
privileges and should not be run from a shell
that is confined by an AppArmor profile.
aa-unconfined
does not distinguish between one network interface and another,
so it reports all unconfined processes, even those that might be listening to an internal
LAN interface.
Finding user network client applications is dependent on your user preferences. The
aa-unconfined
tool detects and reports network ports opened by client applications,
but only those client applications that are running at the time the
aa-unconfined
analysis is performed. This is a problem because network services tend to be running
all the time, while network client applications tend only to be running when the user is
interested in them.
Applying Novell AppArmor profiles to user network client applications is also dependent
on user preferences. Therefore, we leave profiling of user network client applications
as an exercise for the user.
To aggressively confine desktop applications, the
aa-unconfined
command supports
a
paranoid
option, which reports all processes running and the corresponding App-
Armor profiles that might or might not be associated with each process. The user can
then decide whether each of these programs needs an AppArmor profile.
If you have new or modified profiles, you can submit them to the apparmor-gener-
al@forge.novell.com [
mailto:apparmor-general@forge.novell.com
]
mailing list along with a use case for the application behavior that you exercised. The
AppArmor team reviews and may submit the work into SUSE Linux Enterprise Server.
We cannot guarantee that every profile will be included, but we make a sincere effort
to include as much as possible so that end users can contribute to the security profiles
that ship in SUSE Linux Enterprise Server.
Alternatively, use the AppArmor profile repository to make your profiles available to
other users and to download profiles created by other AppArmor users and the AppArmor
developers. Refer to
Section 22.2, “Using the External Repository” (page 262) for more
information on how to use the AppArmor profile repository.
Immunizing Programs 233