Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 269

Manually activating enforce mode (using the command line) adds a flag to the top of
the profile so that /bin/foo becomes /bin/foo flags=(enforce). To use
enforce mode, open a terminal window and enter one of the following lines as root.
• If the example program (program1) is in your path, use:
aa-enforce [program1 program2 ...]
• If the program is not in your path, specify the entire path, as follows:
aa-enforce /sbin/program1
• If the profiles are not in /etc/apparmor.d, use the following to override the
default location:
aa-enforce /path/to/profiles/program1
• Specify the profile for program1 as follows:
aa-enforce /etc/apparmor.d/sbin.program1
Each of the above commands activates the enforce mode for the profiles and programs
listed.
If you do not enter the program or profile names, you are prompted to enter one.
/path/to/profiles overrides the default location of /etc/apparmor.d.
The argument can be either a list of programs or a list of profiles. If the program name
does not include its entire path, aa-enforce searches $PATH for the program.
TIP: Toggling Profile Mode with YaST
YaST offers a graphical front-end for toggling complain and enforce mode. See
Section 23.6.2, "Changing the Mode of Individual Profiles"
mation.
aa-genprof—Generating Profiles
aa-genprof is AppArmor's profile generating utility. It runs aa-autodep on the specified
program, creating an approximate profile (if a profile does not already exist for it), sets
(page 244) for infor-
Building Profiles from the Command Line 257