Once the dbus dispatcher is configured correctly, add the AppArmor Desktop Monitor
to the GNOME panel by right-clicking the panel and selecting Add to Panel > AppArmor
Desktop Monitor. As soon as a
REJECT
event is logged, the applet's panel icon changes
appearance and you can click the applet to see the number of reject events per confined
application. To view the exact log messages, refer to the audit log under
/var/log/
audit/audit.log
. React to any
REJECT
events as described in
Section 6.5, “Re-
acting to Security Event Rejections”
(page 112).
6.5 Reacting to Security Event
Rejections
When you receive a security event rejection, examine the access violation and determine
if that event indicated a threat or was part of normal application behavior. Application-
specific knowledge is required to make the determination. If the rejected action is part
of normal application behavior, run
aa-logprof
at the command line or the Update
Profile Wizard in Novell AppArmor to update your profile.
If the rejected action is not part of normal application behavior, this access should be
considered a possible intrusion attempt (that was prevented) and this notification should
be passed to the person responsible for security within your organization.
6.6 Maintaining Your Security Profiles
In a production environment, you should plan on maintaining profiles for all of the de-
ployed applications. The security policies are an integral part of your deployment. You
should plan on taking steps to back up and restore security policy files, plan for software
changes, and allow any needed modification of security policies that your environment
dictates.
6.6.1 Backing Up Your Security Profiles
Because you take the time to make profiles, it makes sense to back them up. Backing
up profiles might save you from having to reprofile all your programs after a disk crash.
Also, if profiles are changed, you can easily restore previous settings by using the
backed up files.
112
Novell AppArmor Administration Guide
