AA-LOGPROF(8)

💅 AA-LOGPROF(8) — the AppArmor glow-up tool

okay so bestie, welcome to aa-logprof(8), straight out of the AppArmor manual set 🎀 this is the interactive bestie that reads your logs and slays your security profiles into shape. No cap.

---

✨ NAME ✨

aa-logprof — utility for updating AppArmor security profiles 💖

---

🌸 SYNOPSIS 🌸

aa-logprof [-d  /path/to/profiles] [-f /path/to/logfile] [-m <mark in
logfile>]

---

🦋 OPTIONS 🦋

• -d, --dir /path/to/profiles — tells it where the AppArmor security profile set lives. The default is /etc/apparmor.d, periodt.
• -f, --file /path/to/logfile — points at the logfile holding your AppArmor security events. The default locations get read out of /etc/apparmor/logprof.conf. The typical defaults are lowkey iconic:

/var/log/audit/audit.log
/var/log/syslog
/var/log/messages

• -m, --logmark "mark" — aa-logprof will straight up ignore every event in the system log that happened before it sees the mark you specified. 🙈 and if your mark has spaces in it? it must be wrapped in quotes or it will not work correctly, fr fr.

---

💜 DESCRIPTION 💜

aa-logprof is an interactive tool — like, a whole conversation — used to review AppArmor generated messages and update AppArmor security profiles. 🫶

Running aa-logprof scans the log file, and if there are new AppArmor events that aren't covered by the existing profile set, you get prompted with suggested modifications to augment the profile. it's giving helpful.

When aa-logprof exits, profile changes are saved to disk. and if AppArmor is running, the updated profiles get reloaded — and if any processes that generated AppArmor events are still running in the null-complain-profile, those processes are set to run under their proper profiles. main character energy for real 👑

🎀 Responding to AppArmor Events 🎀

aa-logprof generates a list of suggested profile changes that you can choose from — or you can create your own — to modify the permission set of the profile so that the access violation that got generated won't re-occur. no more repeat offenders 💅

Then you get presented with info about the access, including the profile, the path, the old mode if there was a previous entry in the profile for this path, the new mode, the suggestion list, and you're given these options:

(A)llow, (D)eny, (I)gnore, (N)ew, (G)lob last piece, (Q)uit

If the AppArmor profile was in complain mode when the event was generated, the default for this option is (A)llow — otherwise, it's (D)eny.

🔥 the (D)eny option adds a deny rule to the AppArmor profile, which silences logging. (yes, silences it — that's the whole point, bestie.)

The (I)gnore option lets you ignore the event without making any changes to the AppArmor profile. sometimes the move is literally doing nothing 🙈

The suggestion list comes at you as a numbered list: includes at the top, the literal path in the middle, and the suggested globs at the bottom. If any globs are being suggested, the shortest glob is the selected option — otherwise, the literal path is selected. Picking includes from the list has to be done manually, iykyk.

Hitting a numbered key changes the selected option to the corresponding numbered entry in the list. 🔢

If you select (N)ew, you'll be prompted to enter your own globbed entry to match the path. And if the glob you typed doesn't match the path for this event, you'll be informed and you get the option to fix it. we love a second chance.

If you select (G)lob last piece, then — taking the currently selected option — aa-logprof removes the last path element and replaces it with /*. ✨

And if the last path element already was /*, aa-logprof goes up a directory level and replaces it with /**.

This new globbed entry then gets added to the suggestion list and marked as the selected option. Obsessed.

So /usr/share/themes/foo/bar/baz.gif can be turned into /usr/share/themes/** by hitting g three times. 🎯

If you select (A)llow, aa-logprof takes the current selection and adds it to the profile — deleting other entries in the profile that are matched by the new entry. careful bestie, it's doing a little cleanup.

Adding r access to /usr/share/themes/** would delete an entry for r access to /usr/share/themes/foo/*.gif if it exists in the profile. see? matched and removed.

If (Q)uit is selected at this point, aa-logprof will ignore all new pending accesses. bye 👋

After all of the accesses have been handled, logrof will write all updated profiles to the disk and reload them if AppArmor is running.

🌈 New Process (Execution) Events 🌈

If there are unhandled x accesses generated by the execve(2) of a new process, aa-logprof displays the parent profile and the target program that's being executed, and prompts you to select an execute modifier. These modifiers give you a choice for the target to:

• have its own profile (px)
• inherit the parent's profile (ix)
• run unconstrained (ux)
• deny access for the target

See apparmor.d(5) for details. 📖

If there's a corresponding entry for the target in the qualifiers section of /etc/apparmor/logprof.conf, the presented list will contain only the allowed modes. slay, filtering.

The default option for this question is selected using this logic:

# if px mode is allowed and profile exists for the target
#   px is default.
# else if ix mode is allowed
#   ix is default
# else
#   deny is default

and heads up: aa-logprof will never suggest "ux" as the default. not today, not ever 💀

🧚 ChangeHat Events 🧚

If unknown aa_change_hat(2) events are found, you get prompted to:

• add a new hat, or
• have the events go into the default hat for this profile based on the corresponding entry in the defaulthat section of logprof.conf, or
• deny altogether the following events that run under that hat.

pick your fighter 🎀

⭐ Capability Events ⭐

If there are capability accesses, you're shown each capability access and asked if the capability should be allowed, denied, or if you want to quit. See capability(7) for details. 🔥

---

💀 BUGS 💀

If you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>. don't be shy, they wanna know 🫶

---

👑 SEE ALSO 👑

klogd(8), auditd(8), apparmor(7), apparmor.d(5), aa_change_hat(2), logprof.conf(5), aa-genprof(1), aa-enforce(1), aa-complain(1), aa-disable(1), and <https://wiki.apparmor.net>. the whole friend group 💖

---

and that's the page, bestie!! this one's AppArmor 4.1.7, dated 2026-05-19 🌸 go forth and let your profiles eat ✨💅