[apparmor] Apparmor - Basic queries

[Murali Selvaraj]

Hi All,

Please go through the below details and clarify with examples.

Q1:How do we identify required capabilities from apparmor logs.

I am looking to find out the list of capabilities are used for the
application/process using apparmor.
I have set up the apparmor and am able to see few capabilities NOT all CAPs
in apparmor logs.
Do we have any simple exercise/method to find the required capabilities for
the process specific from apparmor logs.
It will help us to set the required capabilities for the security reason.

Q2:How do we know the process/application enough to cover  full code
coverage for its required capabilities?

Do we have any suggested procedure/method to confirm the coverage of
application, especially for real-time application?

Q3:  In case of long run test cases, how to ensure all apparmor event logs
are stored even uptime is more than 2 days?

Do we have any configuration to keep apparmor logs for more than 2 days?

Thanks
Murali.S
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20200824/a9259fb9/attachment.html>