Sep 13 17:48:52 figwit root: GenProf:
e2ff78636296f16d0b5301209a04430d
3
When prompted by the tool, run the application to profile in another terminal
window and perform as many of the application functions as possible. Thus, the
learning mode can log the files and directories to which the program requires
access in order to function properly. For example, in a new terminal window,
enter
rcapache2 start
.
4
Select from the following options that are available in the aa-logprof terminal
window after you have executed the program function:
•
S
runs aa-logprof on the system log from where it was marked when aa-
genprof was started and reloads the profile. If system events exist in the log,
AppArmor parses the learning mode log files. This generates a series of
questions that you must answer to guide aa-genprof in generating the security
profile.
•
F
exits the tool and returns to the main menu.
NOTE
If requests to add hats appear, proceed to
Chapter 5, Profiling Your Web
Applications Using ChangeHat
(page 75).
5
Answer two types of questions:
• A resource is requested by a profiled program that is not in the profile (see
Example 4.1, “Learning Mode Exception: Controlling Access to Specific
Resources”
(page 62)).
• A program is executed by the profiled program and the security domain
transition has not been defined (see
Example 4.2, “Learning Mode Exception:
Defining Execute Permissions for an Entry”
(page 63)).
Each of these categories results in a series of questions that you must answer to
add the resource or program to the profile.
Example 4.1, “Learning Mode Excep-
tion: Controlling Access to Specific Resources”
(page 62) and
Example 4.2,
“Learning Mode Exception: Defining Execute Permissions for an Entry”
Building Profiles from the Command Line
61
