mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 08:24:42 +01:00
197 lines
4.9 KiB
Text
197 lines
4.9 KiB
Text
# This publication is intellectual property of Novell Inc. and Canonical
|
|
# Ltd. Its contents can be duplicated, either in part or in whole, provided
|
|
# that a copyright label is visibly located on each copy.
|
|
#
|
|
# All information found in this book has been compiled with utmost
|
|
# attention to detail. However, this does not guarantee complete accuracy.
|
|
# Neither SUSE LINUX GmbH, Canonical Ltd, the authors, nor the translators
|
|
# shall be held liable for possible errors or the consequences thereof.
|
|
#
|
|
# Many of the software and hardware descriptions cited in this book
|
|
# are registered trademarks. All trade names are subject to copyright
|
|
# restrictions and may be registered trade marks. SUSE LINUX GmbH
|
|
# and Canonical Ltd. essentially adhere to the manufacturer's spelling.
|
|
#
|
|
# Names of products and trademarks appearing in this book (with or without
|
|
# specific notation) are likewise subject to trademark and trade protection
|
|
# laws and may thus fall under copyright restrictions.
|
|
#
|
|
|
|
|
|
=pod
|
|
|
|
=head1 NAME
|
|
|
|
aa-status - display various information about the current AppArmor
|
|
policy.
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
B<aa-status> [option]
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
B<aa-status> will report various aspects of the current state of
|
|
AppArmor confinement. By default, it displays the same information as if
|
|
the I<--verbose> argument were given. A sample of what this looks like
|
|
is:
|
|
|
|
apparmor module is loaded.
|
|
110 profiles are loaded.
|
|
102 profiles are in enforce mode.
|
|
8 profiles are in complain mode.
|
|
Out of 129 processes running:
|
|
13 processes have profiles defined.
|
|
8 processes have profiles in enforce mode.
|
|
5 processes have profiles in complain mode.
|
|
|
|
Other argument options are provided to report individual aspects, to
|
|
support being used in scripts.
|
|
|
|
=head1 OPTIONS
|
|
|
|
B<aa-status> accepts only one argument at a time out of:
|
|
|
|
=over 4
|
|
|
|
=item --enabled
|
|
|
|
returns error code if AppArmor is not enabled.
|
|
|
|
=item --profiled
|
|
|
|
displays the number of loaded AppArmor policies.
|
|
|
|
=item --enforced
|
|
|
|
displays the number of loaded enforcing AppArmor policies.
|
|
|
|
=item --complaining
|
|
|
|
displays the number of loaded non-enforcing AppArmor policies.
|
|
|
|
=item --kill
|
|
|
|
displays the number of loaded enforcing AppArmor policies that will
|
|
kill tasks on policy violations.
|
|
|
|
=item --prompt
|
|
|
|
displays the number of loaded enforcing AppArmor policies, with
|
|
fallback to userspace mediation.
|
|
|
|
=item --special-unconfined
|
|
|
|
displays the number of loaded non-enforcing AppArmor policies that are
|
|
in the special unconfined mode.
|
|
|
|
=item --process-mixed
|
|
displays the number of processes confined by profile stacks with
|
|
profiles in different modes.
|
|
|
|
=item --verbose
|
|
|
|
displays multiple data points about loaded AppArmor policy
|
|
set (the default action if no arguments are given).
|
|
|
|
=item --json
|
|
|
|
displays multiple data points about loaded AppArmor policy
|
|
set in a JSON format, fit for machine consumption.
|
|
|
|
=item --pretty-json
|
|
|
|
same as --json, formatted to be readable by humans as well
|
|
as by machines.
|
|
|
|
=item --show
|
|
|
|
what data sets to show information about. Currently I<processes>,
|
|
I<profiles>, I<all> for both processes and profiles. The default is
|
|
I<all>.
|
|
|
|
=item --count
|
|
|
|
display only counts for selected information.
|
|
|
|
=item --filter.mode=filter
|
|
|
|
Allows specifying a posix regular expression filter that will be
|
|
applied against the displayed processes and profiles apparmor profile
|
|
mode, reducing the output.
|
|
|
|
=item --filter.profiles=filter
|
|
|
|
Allows specifying a posix regular expression filter that will be
|
|
applied against the displayed processes and profiles confining
|
|
profile, reducing the output.
|
|
|
|
=item --filter.pid=filter
|
|
|
|
Allows specifying a posix regular expression filter that will be
|
|
applied against the displayed processes, so that only processes pids
|
|
matching the expression will be displayed.
|
|
|
|
=item --filter.exe=filter
|
|
|
|
Allows specifying a posix regular expression filter that will be
|
|
applied against the displayed processes, so that only processes
|
|
executable name matching the expression will be displayed.
|
|
|
|
=item --help
|
|
|
|
displays a short usage statement.
|
|
|
|
=back
|
|
|
|
=head1 EXIT STATUS
|
|
|
|
Upon exiting, B<aa-status> will set its exit status to the
|
|
following values:
|
|
|
|
=over 4
|
|
|
|
=item B<0>
|
|
|
|
if apparmor is enabled and policy is loaded.
|
|
|
|
=item B<1>
|
|
|
|
if apparmor is not enabled/loaded.
|
|
|
|
=item B<2>
|
|
|
|
if apparmor is enabled but no policy is loaded.
|
|
|
|
=item B<3>
|
|
|
|
if the apparmor control files aren't available under
|
|
/sys/kernel/security/.
|
|
|
|
=item B<4>
|
|
|
|
if the user running the script doesn't have enough privileges to read
|
|
the apparmor control files.
|
|
|
|
=item B<42>
|
|
|
|
if an internal error occurred.
|
|
|
|
=back
|
|
|
|
=head1 BUGS
|
|
|
|
B<aa-status> must be run as root to read the state of the loaded
|
|
policy from the apparmor module. It uses the /proc filesystem to
|
|
determine which processes are confined and so is susceptible to race
|
|
conditions.
|
|
|
|
If you find any additional bugs, please report them at
|
|
L<https://gitlab.com/apparmor/apparmor/-/issues>.
|
|
|
|
=head1 SEE ALSO
|
|
|
|
apparmor(7), apparmor.d(5), and
|
|
L<https://wiki.apparmor.net>.
|
|
|
|
=cut
|