aa-logprof(8)
Interactive tool to update AppArmor security profiles based on system audit logs.
Synopsis
aa-logprof [options]Description
aa-logprof scans system logs (typically /var/log/audit/audit.log) for AppArmor denials and presents them interactively, allowing you to update profiles by choosing to allow, deny, or ignore each violation. It prompts for each new rule and lets you decide whether to add permissions to the profile or keep them restricted.
This tool is essential for developing and tuning AppArmor profiles, especially when moving from complain mode to enforce mode. It reduces the manual effort of reading raw audit logs and editing profile files directly.
Common options
| Flag | What it does |
|---|---|
-f <logfile> | Use an alternate log file instead of the default audit log |
-d <dir> | Use profiles from a specific directory instead of /etc/apparmor.d/ |
-m | Manage (override) existing rules; used when reprocessing logs |
-r | Remove entries from the profile instead of adding them |
-o <dir> | Write updated profiles to a specific output directory |
Examples
Start interactive profile update tool, reading from default audit log
aa-logprofParse denials from syslog instead of audit.log
aa-logprof -f /var/log/syslogRun with sudo to have permission to read audit logs and modify profiles
sudo aa-logprofLoad profiles from custom directory for testing before deployment
aa-logprof -d /tmp/custom_profilesWrite modified profiles to output directory without changing system profiles
aa-logprof -o /tmp/updated_profilesReprocess logs and override existing rules in profiles
aa-logprof -m