Novell APPARMOR 1.2, Руководство администратора, Страница: 50 / 130

3.4.1 Checking the SubDomain Module
Status
The SubDomain module can be in any one of three states:
Unloaded
The SubDomain module is not loaded into the kernel.
Running
The SubDomain module is loaded into the kernel and is enforcing Novell AppArmor
program policies.
Stopped
The SubDomain module is loaded into the kernel, but there are no policies being
enforced.
You can detect which of the three states that the SubDomain module is in by inspecting
/subdomain/profiles
. If
cat /subdomain/profiles
reports a list of
profiles, Novell AppArmor is running. If it is empty and returns nothing, SubDomain
is stopped. If the file does not exist, SubDomain is unloaded.
The SubDomain module can be loaded and unloaded with the standard Linux module
commands such as
modprobe
,
insmod
,
lsmod
, and
rmmod
, but this approach is
not recommended. Instead, it is recommended to manage Novell AppArmor through
the script
rcsubdomain
, which can perform the following operations:
rcsubdomain start
Has different behaviors depending on the SubDomain module state. If it was un-
loaded,
start
loads the module and starts it, putting it in the running state. If it
was stopped, then
start
causes the module to rescan the Novell AppArmor profiles
usually found in
/etc/subdomain.d
and puts the module in the running state.
If the module was already running,
start
reports a warning and takes no action.
rcsubdomain stop
Stops SubDomain module (if it was running) by removing all profiles from kernel
memory, effectively disabling all access controls, putting the module into the
stopped state. If the SubDomain module was either unloaded or already stopped,
stop
tries to unload the profiles again, but nothing happens.
50