Apart from transparently enabling and disabling aa-eventd via the YaST modules, you
can manually toggle its status with the
rcaaeventd
init script. The AppArmor event
daemon is not required for proper functioning of the profiling process (such as enforce-
ment or learning). It is just required for reporting.
Find more details on security event notification in
Section 6.2, “Configuring Security
Event Notification”
(page 88) and on scheduled reports in
Section 6.3, “Configuring
Reports”
(page 91).
6.2 Configuring Security Event
Notification
Security event notification is a Novell AppArmor feature that informs you when systemic
Novell AppArmor activity occurs. Activate it by selecting a notification frequency
(receiving daily notification, for example). Enter an e-mail address, so you can be noti-
fied via e-mail when Novell AppArmor security events occur. Select one of the following
notification types:
Terse
Terse notification summarizes the total number of system events without providing
details. For example:
[email protected] has had 29 security events since Mon May 22 16:32:38 2006
Summary Notification
Summary notification displays the logged Novell AppArmor security events and
lists the number of individual occurrences, including the date of the last occurrence.
For example:
AppArmor: PERMITTING access to capability ’setgid’ (httpd2-prefork(6347)
profile /usr/sbin/httpd2-prefork active /usr/sbin/httpd2-prefork) 2 times,
the latest at Sat Oct 9 16:05:54 2004.
Verbose Notification
Verbose notification displays unmodified, logged Novell AppArmor security events.
It tells you every time an event occurs and writes a new line in the verbose log.
These security events include the date and time the event occurred, when the appli-
cation profile permits and rejects access, and the type of file permission access that
is permitted or rejected. Verbose notification also reports several messages that the
88
Novell AppArmor Administration Guide
