Login or Register to Ask a Question and Join Our Community

Linux and UNIX Man Pages

Linux & Unix Commands - Search Man Pages

apparmor_status(8) [linux man page]

AA-STATUS(8)							     AppArmor							      AA-STATUS(8)

NAME

       aa-status - display various information about the current AppArmor policy.

SYNOPSIS

       aa-status [option]

DESCRIPTION

       aa-status will report various aspects of the current state of AppArmor confinement. By default, it displays the same information as if the
       --verbose argument were given. A sample of what this looks like is:

	 apparmor module is loaded.
	 110 profiles are loaded.
	 102 profiles are in enforce mode.
	 8 profiles are in complain mode.
	 Out of 129 processes running:
	 13 processes have profiles defined.
	 8 processes have profiles in enforce mode.
	 5 processes have profiles in complain mode.

       Other argument options are provided to report individual aspects, to support being used in scripts.

OPTIONS

       aa-status accepts only one argument at a time out of:

       --enabled
	   returns error code if AppArmor is not enabled.

       --profiled
	   displays the number of loaded AppArmor policies.

       --enforced
	   displays the number of loaded enforcing AppArmor policies.

       --complaining
	   displays the number of loaded non-enforcing AppArmor policies.

       --verbose
	   displays multiple data points about loaded AppArmor policy set (the default action if no arguments are given).

       --help
	   displays a short usage statement.

BUGS

       aa-status must be run as root to read the state of the loaded policy from the apparmor module. It uses the /proc filesystem to determine
       which processes are confined and so is susceptible to race conditions.

       Upon exiting, aa-status will set its return value to the following values:

       0   if apparmor is enabled and policy is loaded.

       1   if apparmor is not enabled/loaded.

       2   if apparmor is enabled but no policy is loaded.

       3   if the apparmor control files aren't available under /sys/kernel/security/.

       4   if the user running the script doesn't have enough privileges to read the apparmor control files.

       If you find any additional bugs, please report them at <http://https://bugs.launchpad.net/apparmor/+filebug>.

SEE ALSO

       apparmor(7), apparmor.d(5), and <http://wiki.apparmor.net>.

AppArmor 2.7.0~beta1						    2010-12-20							      AA-STATUS(8)

Check Out this Related Man Page

AA-GENPROF(8)                                                        AppArmor                                                        AA-GENPROF(8)

NAME

       aa-genprof - profile generation utility for AppArmor

SYNOPSIS

       aa-genprof <executable> [-d /path/to/profiles]

OPTIONS

       -d --dir /path/to/profiles

          Specifies where to look for the AppArmor security profile set.
          Defaults to /etc/apparmor.d.

DESCRIPTION

       When running aa-genprof, you must specify a program to profile.  If the specified program is not a fully-qualified path, aa-genprof will
       search $PATH in order to find the program.

       If a profile does not exist for the program, aa-genprof will create one using aa-autodep(1).

       Genprof will then:

          - set the profile to complain mode

          - write a mark to the system log

          - instruct the user to start the application to
            be profiled in another window and exercise its functionality

       It then presents the user with two options, (S)can system log for entries to add to profile and (F)inish.

       If the user selects (S)can or hits return, aa-genprof will parse the complain mode logs and iterate through generated violations using
       aa-logprof(1).

       After the user finishes selecting profile entries based on violations that were detected during the program execution, aa-genprof will
       reload the updated profiles in complain mode and again prompt the user for (S)can and (D)one. This cycle can then be repeated as necessary
       until all application functionality has been exercised without generating access violations.

       When the user eventually hits (F)inish, aa-genprof will set the main profile, and any other profiles that were generated, into enforce mode
       and exit.

BUGS

       If you find any bugs, please report them at <http://https://bugs.launchpad.net/apparmor/+filebug>.

SEE ALSO

       apparmor(7), apparmor.d(5), aa-enforce(1), aa-complain(1), aa-disable(1), aa_change_hat(2), aa-logprof(1), logprof.conf(5), and
       <http://wiki.apparmor.net>.

AppArmor 2.7.103                                                    2012-06-28                                                       AA-GENPROF(8)
Man Page