Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 311 / 450

Manually activating enforce mode (using the command line) adds a flag to the top of
the profile so that
/bin/foo
becomes
/bin/foo flags=(enforce)
. To use
enforce mode, open a terminal window and enter one of the following lines as
root
.
• If the example program ( program1
) is in your path, use:
aa-enforce [ program1 program2 ...]
• If the program is not in your path, specify the entire path, as follows:
aa-enforce /sbin/ program1
• If the profiles are not in /etc/apparmor.d
, use the following to override the
default location:
aa-enforce /path/to/profiles/program1
• Specify the profile for program1
as follows:
aa-enforce /etc/apparmor.d/sbin. program1
Each of the above commands activates the enforce mode for the profiles and programs
listed.
If you do not enter the program or profile names, you are prompted to enter one.
/path/to/profiles
overrides the default location of
/etc/apparmor.d
.
The argument can be either a list of programs or a list of profiles. If the program name
does not include its entire path, aa-enforce searches
$PATH
for the program.
TIP: Toggling Profile Mode with YaST
YaST offers a graphical front-end for toggling complain and enforce mode. See
Section 23.6.2, “Changing the Mode of Individual Profiles” (page 284) for infor-
mation.
aa-genprof—Generating Profiles
aa-genprof is AppArmor's profile generating utility. It runs aa-autodep on the specified
program, creating an approximate profile (if a profile does not already exist for it), sets
Building Profiles from the Command Line 297