aa-autodep [ -d /path/to/profiles ] [program1 program2...]
If you do not enter the program name or names, you are prompted for them.
/path/to/profiles
overrides the default location of
/etc/apparmor.d
,
should you keep profiles in a location other than the default.
To begin profiling, you must create profiles for each main executable service that is
part of your application (anything that might start without being a child of another
program that already has a profile). Finding all such programs depends on the application
in question. Here are several strategies for finding such programs:
Directories
If all the programs to profile are in one directory and there are no other programs
in that directory, the simple command
aa-autodep
/path/to/your/programs/*
creates basic profiles for all programs in that
directory.
ps command
You can run your application and use the standard Linux
ps
command to find all
processes running. Then manually hunt down the location of these programs and
run the
aa-autodep
for each one. If the programs are in your path, aa-autodep
finds them for you. If they are not in your path, the standard Linux command
find
might be helpful in finding your programs. Execute
find / -name
'
my_application
to determine an application's path
(
my_application
being an example application). You may use wild cards if
appropriate.
aa-complain—Entering Complain or Learning Mode
The complain or learning mode tool (aa-complain) detects violations of AppArmor
profile rules, such as the profiled program accessing files not permitted by the profile.
The violations are permitted, but also logged. To improve the profile, turn complain
mode on, run the program through a suite of tests to generate log events that characterize
the program's access needs, then postprocess the log with the AppArmor tools to
transform log events into improved profiles.
Manually activating complain mode (using the command line) adds a flag to the top of
the profile so that
/bin/foo
becomes
/bin/foo flags=(complain)
. To use
complain mode, open a terminal window and enter one of the following lines as
root
:
Building Profiles from the Command Line
57
