Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 267

aa-autodep [ -d /path/to/profiles ] [program1 program2...]
If you do not enter the program name or names, you are prompted for them.
/path/to/profiles overrides the default location of /etc/apparmor.d,
should you keep profiles in a location other than the default.
To begin profiling, you must create profiles for each main executable service that is
part of your application (anything that might start without being a child of another
program that already has a profile). Finding all such programs depends on the application
in question. Here are several strategies for finding such programs:
Directories
If all the programs to profile are in one directory and there are no other programs
in that directory, the simple command aa-autodep
/path/to/your/programs/* creates basic profiles for all programs in that
directory.
ps command
You can run your application and use the standard Linux ps command to find all
processes running. Then manually hunt down the location of these programs and
run the aa-autodep for each one. If the programs are in your path, aa-autodep
finds them for you. If they are not in your path, the standard Linux command find
might be helpful in finding your programs. Execute find / -name
'my_application' -print to determine an application's path
(my_application being an example application). You may use wild cards if
appropriate.
aa-complain—Entering Complain or Learning Mode
The complain or learning mode tool (aa-complain) detects violations of AppArmor
profile rules, such as the profiled program accessing files not permitted by the profile.
The violations are permitted, but also logged. To improve the profile, turn complain
mode on, run the program through a suite of tests to generate log events that characterize
the program's access needs, then postprocess the log with the AppArmor tools to
transform log events into improved profiles.
Manually activating complain mode (using the command line) adds a flag to the top of
the profile so that /bin/foo becomes /bin/foo flags=(complain). To use
complain mode, open a terminal window and enter one of the following lines as root:
Building Profiles from the Command Line 255