• If the example program (
program1
) is in your path, use:
aa-enforce [program1 program2 ...]
• If the program is not in your path, specify the entire path, as follows:
aa-enforce /sbin/program1
• If the profiles are not in
/etc/apparmor.d
, use the following to override the
default location:
aa-enforce /path/to/profiles/program1
• Specify the profile for
program1
as follows:
aa-enforce /etc/apparmor.d/sbin.program1
Each of the above commands activates the enforce mode for the profiles and programs
listed.
If you do not enter the program or profile names, you are prompted to enter one.
/path/to/profiles
overrides the default location of
/etc/apparmor.d
.
The argument can be either a list of programs or a list of profiles. If the program name
does not include its entire path, aa-enforce searches
$PATH
for the program.
TIP: Toggling Profile Mode with YaST
YaST offers a graphical front-end for toggling complain and enforce mode. See
Section 3.6.2, “Changing the Mode of Individual Profiles”
(page 47) for infor-
mation.
aa-genprof—Generating Profiles
aa-genprof is AppArmor's profile generating utility. It runs aa-autodep on the specified
program, creating an approximate profile (if a profile does not already exist for it), sets
it to complain mode, reloads it into AppArmor, marks the log, and prompts the user to
execute the program and exercise its functionality. Its syntax is as follows:
aa-genprof [ -d /path/to/profiles ] program
Building Profiles from the Command Line
59
