Novell APPARMOR 1.2, Руководство администратора, Страница: 57 / 130

autodep
This creates an approximate profile for the program or application you are autodepping.
You can generate approximate profiles for binary executables and interpreted script
programs. The resulting profile is called “approximate” because it does not necessarily
contain all of the profile entries that the program needs to be properly confined by
Novell AppArmor. The minimum autodep approximate profile has at least a base include
directive, which contains basic profile entries needed by most programs. For certain
types of programs, autodep generates a more expanded profile. The profile is generated
by recursively calling
ldd(1)
on the executables listed on the command line.
To generate an approximate profile, use the autodep program. The program argument
can be either the simple name of the program, which autodep finds by searching your
shell's path variable, or it can be a fully qualified path. The program itself can be of any
type (ELF binary, shell script, Perl script, etc.) and autodep generates an approximate
profile, to be improved through the dynamic profiling that follows.
The resulting approximate profile is written to the
/etc/subdomain.d
directory
using the Novell AppArmor profile naming convention of naming the profile after the
absolute path of the program, replacing the forward slash (
/
) characters in the path with
period (
.
) characters. The general form of autodep is to enter the following in a terminal
window when logged in as root:
autodep [ -d /path/to/profiles ] [ program1 program2 ...]
If you do not enter the program name or names, you are prompted for them.
/path/to/profiles
overrides the default location of
/etc/subdomain.d
.
To begin profiling, you must create profiles for each main executable service that is
part of your application (anything that might start without being a child of another
program that already has a profile). Finding all such programs depends on the application
in question. Here are several strategies for finding such programs:
Directories
If all of the programs you want to profile are in a directory and there are no other
programs in that directory, the simple command
autodep
/path/to/your/programs/*
creates nominal profiles for all programs in
that directory.
Building Novell AppArmor Profiles 57