aa-genprof(8)
Generate an AppArmor security profile for an application by monitoring its behavior.
Synopsis
aa-genprof [options] <executable_path>Description
aa-genprof is an interactive utility that creates AppArmor security profiles by profiling an application's system calls and file access patterns. It monitors the target executable in complain mode, logs its activities, and then guides you through accepting or denying each detected capability to build a restrictive profile.
The tool is essential for system administrators and security practitioners who need to confine untrusted or sensitive applications. It combines automatic capability detection with manual policy refinement to produce practical, enforceable profiles.
Common options
| Flag | What it does |
|---|---|
-d DIR | Specify alternate AppArmor profile directory (default: /etc/apparmor.d) |
-f FILE | Read profile from file instead of standard location |
-r | Remove the profile and restart the application in profiling mode |
-w | Write the generated profile to disk immediately |
--abort | Exit without writing the profile or restarting the application |
-t TIMEOUT | Set timeout in seconds for monitoring the application (default: infinite) |
Examples
Start interactive profiling of mysqld; monitor its activity and build a profile rule by rule
aa-genprof /usr/sbin/mysqldGenerate profile for nginx using the standard AppArmor profile directory
aa-genprof -d /etc/apparmor.d /usr/bin/nginxRemove any existing profile for /opt/myapp/service and start fresh profiling
aa-genprof -r /opt/myapp/serviceProfile python3 for exactly 60 seconds, then process the logged events
aa-genprof -t 60 /usr/bin/python3Non-interactively generate a profile by piping empty input (accept all suggestions)
echo | aa-genprof /usr/bin/test_appGenerate and immediately save profile for custom_app in the default directory
sudo aa-genprof -w /home/user/custom_app