Novell APPARMOR 1.2, Руководство администратора, Страница: 58 / 130

ps command
You can run your application and use the standard Linux
ps
command to find all
processes running. You then need to manually hunt down the location of these
programs and run the autodep program for each one. If the programs are in your
path, autodep finds them for you. If they are not in your path, the standard Linux
command
locate
might be helpful in finding your programs. If
locate
does
not work (it is not installed by default on SUSE Linux), use
find . -name
'*foo*' -print
.
Complain or Learning Mode
The complain or learning mode tool detects violations of Novell AppArmor profile
rules, such as the profiled program accessing files not permitted by the profile. The vi-
olations are permitted, but also logged. To improve the profile, turn complain mode
on, run the program through a suite of tests to generate log events that characterize the
program's access needs then postprocess the log with the Novell AppArmor tools to
transform log events into improved profiles.
Manually activating the complain mode (using the command line) adds a flag to the
top of the profile so that
/bin/foo
becomes
/bin/foo flags=(complain)
.
To use complain mode, open a terminal window and enter one of the following lines
as a root user.
• If the example program (
program1
) is in your path, use:
complain [ program1 program2 ...]
• If the program is not in your path, specify the entire path as follows:
complain /sbin/ program1
• If the profiles are not in
/etc/subdomain.d
, type the following to override the
default location:
complain /path/to/profiles/ program1
• Specify the profile for
program1
, as follows:
complain /etc/subdomain.d/sbin. program1
58