User
’
s
Gui
de
52
3. Exercise Your Application.
Run your application, and exercise its
functionality. How
much
to exercise the program is up to you, but
you will need the program to access each file representing its
access needs. Because the execution is not being supervised by
genprof
, this step can go on for days or weeks, and can span
complete system reboots.
4. Analyze the log.
In Systemic profiling, you run
logprof
directly
instead of letting
genprof
run it for us as in the Standalone Profil-
ing. The general form of
logprof
is:
logprof [ -d /path/to/profiles ] [ -f /path/to/logfile
]
Ref
er
t
o
“
Logprof
”
on
page61
f
or
mor
e
i
nf
or
mat
i
on
on
usi
ng
Log-
prof.
5. Repeat Steps 3-4.
Iterate Step 3 and Step 4 to generate optimum
profiles. An iterative approach captures smaller data sets that can
be trained and reloaded into the policy engine. Subsequent itera-
tions will generate fewer messages and run faster.
6. Edit the Profiles.
You may wish to review the profiles that have
been generated. You can open and edit the profiles in /etc/subdo-
main.d/ using
vim
. For help using
vim
to its fullest capacity, refer to
“
Subdomain.vim
”
on
page67.
7.
Ret
ur
n
t
o
“enf
or
ce”
mode.
This is when the system goes back to
enforcing the rules of the profiles not just logging information. This
can
be
done
manual
l
y,
by
r
emovi
ng
t
he
“
flags=(complain)
“
t
ext
from the profiles, or automatically, using the
enforce
command,
which works identically to the
complain
command, but edits the
profiles to be in enforce mode.
To assure that
all
profiles are taken out of complain mode and put
into enforce mode, type:
enforce /etc/subdomain.d/*
8. Re-scan all profiles.
To have Novell AppArmor re-scan all of the
profiles and change the enforcement mode in the kernel, type:
/etc/init.d/subdomain restart
Summary of Profiling Tools
All of the Novell AppArmor profiling utilities are provided by the
sub-
domain-utils
RPM package, and most are stored in
/usr/sbin
.
Here is a brief summary of each tool:
