Novell APPARMOR 1.2, Руководство администратора, Страница: 55 / 130

it requires genprof to run for the entire duration of the test run of your program (you
cannot reboot the machine while you are still developing your profile).
To use genprof for the stand-alone method of profiling, refer to Section “genprof”
(page 60).
3.5.2 Systemic Profiling
This method is called systemic profiling because it updates all of the profiles on the
system at once, rather than focusing on the one or few being targeted by genprof or
standalone profiling.
With systemic profiling, building and improving profiles are somewhat less automated,
but more flexible. This method is suitable for profiling long-running applications whose
behavior continues after rebooting or a large numbers of programs to profile all at once.
Build a Novell AppArmor profile for a group of applications as follows:
1 Create profiles for the individual programs that make up your application.
Even though this approach is systemic, Novell AppArmor still only monitors
those programs with profiles and their children. Thus, to get Novell AppArmor
to consider a program, you must at least have autodep create an approximate
profile for it. To create this approximate profile, refer to
Section “autodep”
(page 57).
2
Put relevant profiles into learning or complain mode. Activate learning
or complain mode for all profiled programs by entering
complain
/etc/subdomain.d/*
in a terminal window while logged in as root.
When in learning mode, access requests are not blocked even if the profile dictates
that they should be. This enables you to run through several tests (as shown in
Step 3 (page 55)) and learn the access needs of the program so it runs properly.
With this information, you can decide how secure to make the profile.
Refer to Section “Complain or Learning Mode” (page 58) for more detailed in-
structions for using learning or complain mode.
3 Exercise your application. Run your application and exercise its functional-
ity. How much to exercise the program is up to you, but you need the program
to access each file representing its access needs. Because the execution is not
Building Novell AppArmor Profiles 55