that have been triggered during the application's execution. After the profile has
been generated, it is loaded and put into enforce mode. Refer to
Section “aa-gen-
prof—Generating Profiles”
(page 59) for detailed information about this tool.
aa-logprof
aa-logprof interactively scans and reviews the log entries generated by an application
that is confined by an AppArmor profile in complain mode. It assists you in gener-
ating new entries in the profile concerned. Refer to
Section “aa-logprof—Scanning
the System Log”
(page 67) for detailed information about this tool.
aa-complain
aa-complain toggles the mode of an AppArmor profile from enforce to complain.
Exceptions to rules set in a profile are logged, but the profile is not enforced. Refer
to
Section “aa-complain—Entering Complain or Learning Mode”
(page 57) for
detailed information about this tool.
aa-enforce
aa-enforce toggles the mode of an AppArmor profile from complain to enforce.
Exceptions to rules set in a profile are logged, but not permitted—the profile is
enforced. Refer to
Section “aa-enforce—Entering Enforce Mode”
(page 58) for
detailed information about this tool.
Once a profile has been built and is loaded, there are two ways in which it can get pro-
cessed:
complain
In complain mode, violations of AppArmor profile rules, such as the profiled pro-
gram accessing files not permitted by the profile, are detected. The violations are
permitted, but also logged. To improve the profile, turn complain mode on, run the
program through a suite of tests to generate log events that characterize the program's
access needs, then postprocess the log with the AppArmor tools (YaST or aa-log-
prof) to transform log events into improved profiles.
enforce
In enforce mode, violations of AppArmor profile rules, such as the profiled program
accessing files not permitted by the profile, are detected. The violations are logged
and not permitted. The default is for enforce mode to be enabled. To log the viola-
tions only, but still permit them, use complain mode. Enforce toggles with complain
mode.
Immunizing Programs
3
