In this lesson, you will learn how to configure real-time notification alerts so that you are immediately informed when an application violates its AppArmor profile.
Understanding AppArmor Notifications
When you enforce an AppArmor profile, any action an application attempts that falls outside its defined permissions is blocked by the kernel. By default, these denials are logged to the system audit logs (usually found in /var/log/audit/audit.log or /var/log/syslog). However, checking logs manually is reactive. To be proactive, you can use aa-notify to monitor these events in real-time.
Using aa-notify for Real-Time Alerts
The aa-notify tool acts as a bridge between the kernel audit subsystem and your desktop environment or terminal. It parses the audit logs for AppArmor-specific events and triggers a notification whenever a "denied" or "requested" message appears.
To start monitoring, run the following command in your terminal:
sudo aa-notify -p -s 1
In this command:
-ptells the tool to use desktop notifications (libnotify), which will pop up on your screen.-s 1sets the polling interval to 1 minute, ensuring you get updates shortly after a violation occurs.
If you are working on a headless server and prefer console alerts, you can run aa-notify -f, which will follow the log file and print new violations directly to your terminal screen as they happen.
Why This Matters for Hardening
Auditing profile events with notify is essential during the transition from complain mode to enforce mode. When you first move a profile to enforcement, you may discover "false positives"—legitimate operations that were missed during development. By using aa-notify, you can identify these gaps immediately, allowing you to refine your profile’s path-based restrictions or capability requirements without leaving the application in a broken state for an extended period. It turns the silent "blocking" of the kernel into an actionable security signal.
Key Takeaway: Real-time notifications via aa-notify allow you to instantly identify and debug AppArmor policy violations, bridging the gap between passive log analysis and active security enforcement.