Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 306 / 450

24.6.1 Stand-Alone Profiling
Stand-alone profile generation and improvement is managed by a program called aa-
genprof. This method is easy because aa-genprof takes care of everything, but is limited
because it requires aa-genprof to run for the entire duration of the test run of your pro-
gram (you cannot reboot the machine while you are still developing your profile).
To use aa-genprof for the stand-alone method of profiling, refer to Section “aa-gen-
prof—Generating Profiles” (page 297).
24.6.2 Systemic Profiling
This method is called systemic profiling because it updates all of the profiles on the
system at once, rather than focusing on the one or few targeted by aa-genprof or stand-
alone profiling. With systemic profiling, profile construction and improvement are
somewhat less automated, but more flexible. This method is suitable for profiling long-
running applications whose behavior continues after rebooting or a large number of
programs all at once.
Build an AppArmor profile for a group of applications as follows:
1 Create profiles for the individual programs that make up your application.
Although this approach is systemic, AppArmor only monitors those programs
with profiles and their children. To get AppArmor to consider a program, you
must at least have aa-autodep create an approximate profile for it. To create this
approximate profile, refer to
Section “aa-autodep—Creating Approximate Pro-
files” (page 294).
2 Put relevant profiles into learning or complain mode.
Activate learning or complain mode for all profiled programs by entering
aa-complain /etc/apparmor.d/*
in a terminal window while logged
in as
root
. This functionality is also available through the YaST Profile Mode
module, described in Section 23.6.2, “Changing the Mode of Individual Profiles”
(page 284).
When in learning mode, access requests are not blocked even if the profile dictates
that they should be. This enables you to run through several tests (as shown in
292 Security Guide