Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 321 / 450

aa-logprof -d /path/to/profile/directory/
Specifies the full path to the location of the profiles if the profiles are not located
in the standard directory,
/etc/apparmor.d/
.
aa-logprof -f /path/to/logfile/
Specifies the full path to the location of the log file if the log file is not located in
the default directory,
/var/log/audit/audit.log
or
/var/log/
messages
(if auditd is not running).
aa-logprof -m "string marker in logfile"
Marks the starting point for aa-logprof to look in the system log. aa-logprof ignores
all events in the system log before the specified mark. If the mark contains spaces,
it must be surrounded by quotes to work correctly. For example:
aa-logprof -m"17:04:21"
or
logprof -m e2ff78636296f16d0b5301209a04430d
aa-logprof scans the log, asking you how to handle each logged event. Each question
presents a numbered list of AppArmor rules that can be added by pressing the number
of the item on the list.
By default, aa-logprof looks for profiles in
/etc/apparmor.d/
and scans the log
in
/var/log/messages
. In many cases, running
aa-logprof
as
root
is enough
to create the profile.
However, there might be times when you need to search archived log files, such as if
the program exercise period exceeds the log rotation window (when the log file is
archived and a new log file is started). If this is the case, you can enter
zcat -f `ls
-1tr /var/log/messages*` | aa-logprof -f -
.
aa-logprof Example 1
The following is an example of how aa-logprof addresses httpd2-prefork accessing the
file
/etc/group
.
[]
indicates the default option.
In this example, the access to
/etc/group
is part of httpd2-prefork accessing name
services. The appropriate response is
1
, which includes a predefined set of AppArmor
rules. Selecting
1
to
#include
the name service package resolves all of the future
Building Profiles from the Command Line 307