AA-GENPROF(8)

📦
version 6.0.0~alpha1 · 20 versions
, in ubuntu stonking

💅 AA-GENPROF(8) — the AppArmor glow-up page ✨

okay bestie, welcome to aa-genprof, from the AppArmor manual (section 8, system admin stuff, very cunty). this is the profile generation utility for AppArmor and she is genuinely iconic for it. let me walk you through it 🫶

✨ NAME ✨

aa-genprof — profile generation utility for AppArmor

no like that's literally it, that's the whole name section, we eat and we move on 🍓

🌸 SYNOPSIS 🌸

aa-genprof <executable> [-d /path/to/profiles] [-f /path/to/logfile]

look at her. one required argument, two lil optional flags. main character energy fr fr 👑

🎀 OPTIONS 🎀

  • -d, --dir /path/to/profiles — tells her where to go looking for the AppArmor security profile set. if you don't say anything, she defaults to /etc/apparmor.d. that's home base 💖
  • -f, --file /path/to/logfile — says where the logfile lives. the default locations get read out of /etc/apparmor/logprof.conf. the typical defaults are, and I quote, literally:
/var/log/audit/audit.log
/var/log/syslog
/var/log/messages

the way she just reads her config file for the vibes… obsessed 🌈

🦋 DESCRIPTION 🦋

so when you run aa-genprof, you must specify a program to profile. non-negotiable, bestie. and if the program you named isn't a fully-qualified path? she's gonna go search $PATH to hunt it down herself. she's resourceful like that 💅

if there's no profile for that program yet, aa-genprof will create one using aa-autodep(1). building you something from scratch, no cap 🧚

then genprof does the whole little routine:

  • sets the profile to complain mode
  • writes a mark to the system log
  • instructs you (the user) to start the application you're profiling in another window and exercise its functionality

go on girl, go push every button, live your truth 😭

after that she presents you with two options:

  • (S)can — scan the system log for entries to add to the profile
  • (F)inish

if you pick (S)can or you just hit return, aa-genprof will parse the complain mode logs and iterate through the generated violations using aa-logprof(1). the crossover event of the century 🔥

once you're done selecting profile entries based on the violations that got detected while the program was running, aa-genprof reloads the updated profiles back in complain mode and asks you again: (S)can or (F)inish? and this whole cycle just repeats as many times as you need, until you've exercised all the application functionality without generating any access violations. it's giving character development arc 💜

and when you finally do hit (F)inish, aa-genprof sets the main profile — plus any other profiles that got generated — into enforce mode, and exits. slay, completed it, periodt ✨

💀 BUGS 💀

if you find any bugs (not me jinxing it 🙈), please report them at:

<https://gitlab.com/apparmor/apparmor/-/issues>

👑 SEE ALSO 👑

the whole friend group, all linked up, love that for them 🌸

this page is brought to you by AppArmor 6.0.0~alpha1, dated 2026-10-05 — fresh off the press, alpha era, we stan an early release 💖✨

📦 where this page comes from