AA-GENPROF(8)

💅 AA-GENPROF(8) — your girl's guide to the AppArmor profile generation utility

okay bestie, so this is aa-genprof, straight out of the AppArmor manual, section 8 (that's the sysadmin-commands girlies 🎀). it's the profile generation utility and honestly? it's iconic. let's get into it ✨

---

🌸 NAME 🌸

aa-genprof — the profile generation utility for AppArmor. that's the whole vibe. it makes profiles. it generates them. slay 💅

---

✨ SYNOPSIS ✨

aa-genprof <executable> [-d /path/to/profiles] [-f /path/to/logfile]

that's it, that's the incantation 🪄

---

🎀 OPTIONS 🎀

• -d, --dir /path/to/profiles — tells her where the AppArmor security profile set lives. defaults to /etc/apparmor.d if you don't say anything, which is lowkey the main character location 🏠
• -f, --file /path/to/logfile — points at your logfile. the default locations get read from /etc/apparmor/logprof.conf, and the typical defaults are:

/var/log/audit/audit.log
/var/log/syslog
/var/log/messages

three options, all valid, all reading logs for you 🫶

---

💖 DESCRIPTION 💖

so when you run aa-genprof, you must specify a program to profile. non-negotiable, bestie. and if the program you named isn't a fully-qualified path, aa-genprof will search $PATH to find it — she'll go looking for you, fr fr 🔍

if a profile doesn't already exist for that program, aa-genprof creates one using aa-autodep(1). brand new profile, fresh out the box ✨

then genprof does her little routine:

• sets the profile to complain mode (she's being nice about it rn)
• writes a mark to the system log 📝
• instructs you, the user, to start the application you're profiling in another window and exercise its functionality — yes, actually use the app, go touch grass with it 🌱

after that, she presents you with two options: (S)can the system log for entries to add to the profile, or (F)inish.

if you pick (S)can or just hit return, aa-genprof parses the complain mode logs and iterates through the generated violations using aa-logprof(1). it's giving teamwork 🤝

once you're done selecting profile entries based on the violations detected during the program's execution, aa-genprof reloads the updated profiles in complain mode and asks you (S)can and (F)inish again. this cycle repeats as many times as you need until all the application functionality has been exercised without generating access violations. it's a loop, it's a lifestyle, it's fine 💀

and when you finally hit (F)inish? aa-genprof sets the main profile — plus any other profiles that were generated — into enforce mode and exits. periodt. 👑

---

🦋 BUGS 🦋

found a bug? no cap, please report it at <https://gitlab.com/apparmor/apparmor/-/issues>. the girlies on the issue tracker will handle it 🐛

---

🌈 SEE ALSO 🌈

apparmor(7), apparmor.d(5), aa-enforce(1), aa-complain(1), aa-disable(1), aa_change_hat(2), aa-logprof(1), logprof.conf(5), and <https://wiki.apparmor.net> — go read, iykyk 📚

---

ngl this one's a whole journey: complain mode → scan → repeat → enforce. trust the process, bestie 💜

---

and that's the page, bestie — brought to you by AppArmor 4.1.7, dated 2026-05-19. mwah, go profile something 🍓💖