aa-audit

Set AppArmor profiles to audit mode

TLDR

Set a profile to audit mode

$ sudo aa-audit [profile_name]

Set multiple profiles to audit mode

$ sudo aa-audit [profile1] [profile2]

Set a profile to audit mode from a specific directory

$ sudo aa-audit -d /path/to/profiles [profile_name]

Set a profile to audit mode without reloading it

$ sudo aa-audit --no-reload [profile_name]

SYNOPSIS

aa-audit executable [executable ...] [-d /path/to/profiles] [--no-reload]

aa-audit configures AppArmor security profiles to operate in audit mode. In this mode, security policy is enforced and all access attempts (both successes and failures) are logged to the system log. This allows administrators to monitor application behavior while still enforcing security policies.

PARAMETERS

-d, --dir /path/to/profiles

Specifies the directory containing AppArmor profiles; defaults to /etc/apparmor.d

--no-reload

Prevents automatic profile reloading after modifications

-r, --remove

Disable audit mode for the specified profile (reverses the effect of aa-audit).

-h, --help

Display help information

INSTALL

sudo apk add apparmor-utils

sudo zypper install apparmor-utils

nix profile install nixpkgs#apparmor-utils

CAVEATS

Audit mode generates significant log output as it records all access attempts. This can impact system performance and fill up log files quickly on busy systems.

HISTORY

Part of the AppArmor application security framework, developed as an alternative to SELinux for Linux systems. AppArmor was originally developed by Immunix and later acquired by Novell in 2005.