Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 205

NOTE
aa-unconfined requires root privileges and should not be run from a shell
that is confined by an AppArmor profile.
aa-unconfined does not distinguish between one network interface and another,
so it reports all unconfined processes, even those that might be listening to an internal
LAN interface.
Finding user network client applications is dependent on your user preferences. The
aa-unconfined tool detects and reports network ports opened by client applications,
but only those client applications that are running at the time the aa-unconfined
analysis is performed. This is a problem because network services tend to be running
all the time, while network client applications tend only to be running when the user is
interested in them.
Applying Novell AppArmor profiles to user network client applications is also dependent
on user preferences. Therefore, we leave profiling of user network client applications
as an exercise for the user.
To aggressively confine desktop applications, the aa-unconfined command supports
a paranoid option, which reports all processes running and the corresponding App-
Armor profiles that might or might not be associated with each process. The user can
then decide whether each of these programs needs an AppArmor profile.
If you have new or modified profiles, you can submit them to the apparmor-gener-
al@forge.novell.com [mailto:apparmor-general@forge.novell.com]
mailing list along with a use case for the application behavior that you exercised. The
AppArmor team reviews and may submit the work into SUSE Linux Enterprise Desktop.
We cannot guarantee that every profile will be included, but we make a sincere effort
to include as much as possible so that end users can contribute to the security profiles
that ship in SUSE Linux Enterprise Desktop.
Alternatively, use the AppArmor profile repository to make your profiles available to
other users and to download profiles created by other AppArmor users and the AppArmor
developers. Refer to Section 22.2, "Using the External Repository"
information on how to use the AppArmor profile repository.
(page 222) for more
Immunizing Programs 193