Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 264

24.6.1 Stand-Alone Profiling
Stand-alone profile generation and improvement is managed by a program called aa-
genprof. This method is easy because aa-genprof takes care of everything, but is limited
because it requires aa-genprof to run for the entire duration of the test run of your pro-
gram (you cannot reboot the machine while you are still developing your profile).
To use aa-genprof for the stand-alone method of profiling, refer to
prof—Generating Profiles"
24.6.2 Systemic Profiling
This method is called systemic profiling because it updates all of the profiles on the
system at once, rather than focusing on the one or few targeted by aa-genprof or stand-
alone profiling. With systemic profiling, profile construction and improvement are
somewhat less automated, but more flexible. This method is suitable for profiling long-
running applications whose behavior continues after rebooting or a large number of
programs all at once.
Build an AppArmor profile for a group of applications as follows:
1 Create profiles for the individual programs that make up your application.
2 Put relevant profiles into learning or complain mode.
252 Security Guide
Although this approach is systemic, AppArmor only monitors those programs
with profiles and their children. To get AppArmor to consider a program, you
must at least have aa-autodep create an approximate profile for it. To create this
approximate profile, refer to
files" (page 254).
Activate learning or complain mode for all profiled programs by entering
aa-complain /etc/apparmor.d/* in a terminal window while logged
in as root. This functionality is also available through the YaST Profile Mode
module, described in
(page 244).
When in learning mode, access requests are not blocked even if the profile dictates
that they should be. This enables you to run through several tests (as shown in
(page 257).
Section "aa-autodep—Creating Approximate Pro-
Section 23.6.2, "Changing the Mode of Individual Profiles"
Section "aa-gen-