Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 195

Outline the basic profile by running YaST > Novell AppArmor > Add Profile
Wizard and specifying the complete path of the application to profile.
A basic profile is outlined and AppArmor is put into learning mode, which means
that it logs any activity of the program you are executing but does not yet restrict
it.
2 Run the full range of the application's actions to let AppArmor get a very specific
picture of its activities.
3 Let AppArmor analyze the log files generated in
in aa-genprof.
or
Analyze the logs by clicking Scan System Log for AppArmor Events in the Add
Profile Wizard and following the instructions given in the wizard until the profile
is completed.
AppArmor scans the logs it recorded during the application's run and asks you
to set the access rights for each event that was logged. Either set them for each
file or use globbing.
4 Depending on the complexity of your application, it might be necessary to repeat
Step 2 (page 183) and
the confined conditions, and process any new log events. To properly confine
the full range of an application's capabilities, you might be required to repeat this
procedure often.
5 Once all access permissions are set, your profile is set to enforce mode. The
profile is applied and AppArmor restricts the application according to the profile
just created.
If you started aa-genprof on an application that had an existing profile that was
in complain mode, this profile remains in learning mode upon exit of this learning
cycle. For more information about changing the mode of a profile, refer to
"aa-complain—Entering Complain or Learning Mode"
"aa-enforce—Entering Enforce Mode"
Test your profile settings by performing every task you need with the application you
just confined. Normally, the confined program runs smoothly and you do not notice
Step 3 (page 183). Confine the application, exercise it under
(page 256).
(page 183) by typing S
Step 2
(page 255) and
Getting Started
Section
Section
183