Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 266

8 Rescan all profiles.
24.6.3 Summary of Profiling Tools
All of the AppArmor profiling utilities are provided by the apparmor-utils RPM
package and are stored in /usr/sbin. Each tool has a different purpose.
aa-autodep—Creating Approximate Profiles
This creates an approximate profile for the program or application selected. You can
generate approximate profiles for binary executables and interpreted script programs.
The resulting profile is called "approximate" because it does not necessarily contain
all of the profile entries that the program needs to be properly confined by AppArmor.
The minimum aa-autodep approximate profile has at least a base include directive,
which contains basic profile entries needed by most programs. For certain types of
programs, aa-autodep generates a more expanded profile. The profile is generated by
recursively calling ldd(1) on the executables listed on the command line.
To generate an approximate profile, use the aa-autodep program. The program argument
can be either the simple name of the program, which aa-autodep finds by searching
your shell's path variable, or it can be a fully qualified path. The program itself can be
of any type (ELF binary, shell script, Perl script, etc.). aa-autodep generates an approx-
imate profile to improve through the dynamic profiling that follows.
The resulting approximate profile is written to the /etc/apparmor.d directory using
the AppArmor profile naming convention of naming the profile after the absolute path
of the program, replacing the forward slash (/) characters in the path with period (.)
characters. The general form of aa-autodep is to enter the following in a terminal window
when logged in as root:
254 Security Guide
available through the YaST Profile Mode module, described in
"Changing the Mode of Individual Profiles"
To ensure that all profiles are taken out of complain mode and put into enforce
mode, enter aa-enforce /etc/apparmor.d/*.
To have AppArmor rescan all of the profiles and change the enforcement mode
in the kernel, enter rcapparmor restart.
Section 23.6.2,
(page 244).