$linuxjunkies
>

aa-genprof(8)

Generate an AppArmor security profile for an application by monitoring its behavior.

UbuntuDebianFedoraArch

Synopsis

aa-genprof [options] <executable_path>

Description

aa-genprof is an interactive utility that creates AppArmor security profiles by profiling an application's system calls and file access patterns. It monitors the target executable in complain mode, logs its activities, and then guides you through accepting or denying each detected capability to build a restrictive profile.

The tool is essential for system administrators and security practitioners who need to confine untrusted or sensitive applications. It combines automatic capability detection with manual policy refinement to produce practical, enforceable profiles.

Common options

FlagWhat it does
-d DIRSpecify alternate AppArmor profile directory (default: /etc/apparmor.d)
-f FILERead profile from file instead of standard location
-rRemove the profile and restart the application in profiling mode
-wWrite the generated profile to disk immediately
--abortExit without writing the profile or restarting the application
-t TIMEOUTSet timeout in seconds for monitoring the application (default: infinite)

Examples

Start interactive profiling of mysqld; monitor its activity and build a profile rule by rule

aa-genprof /usr/sbin/mysqld

Generate profile for nginx using the standard AppArmor profile directory

aa-genprof -d /etc/apparmor.d /usr/bin/nginx

Remove any existing profile for /opt/myapp/service and start fresh profiling

aa-genprof -r /opt/myapp/service

Profile python3 for exactly 60 seconds, then process the logged events

aa-genprof -t 60 /usr/bin/python3

Non-interactively generate a profile by piping empty input (accept all suggestions)

echo | aa-genprof /usr/bin/test_app

Generate and immediately save profile for custom_app in the default directory

sudo aa-genprof -w /home/user/custom_app

Related commands