apparmor-notify exclude application

Question

Is there a way to exclude certain applications from apparmor-notify notifications. e.g. I don't want to receive any apparmor notifications from firefox but I'd like to receive notifications about the other applications.

Answer 1

It is not possible at this time. But it has been added as one of the possible features that could be added in the future in the apparmor roadmap.

An alternate solution is to "fix" the Firefox profile so that you no longer get denial messages from it.

You can update a profile using the aa-genprof utility using

sudo aa-genprof /etc/apparmor.d/usr.bin.firefox

and follow the prompts/answer the questions.

Alternately you can manually edit the file using a text editor

sudo nano /etc/apparmor.d/usr.bin.firefox

you can add new permissions to the profile by adding the path and access mode and then saving the file. If you do not wish to extend the profile permissions for an access that is being denied and you want to quiet the denied messages you can add a deny rule to the profile, this lets apparmor know that this is a known denial and you do not wish to extend permissions to include the object.

Eg. If you receive a message for

w access to /home/foo/file

You would add a profile rule of

deny /home/foo/file w,

Save the profile file and then load the revised profile into the kernel by doing

sudo /etc/init.d/apparmor restart

or, to reload just the specific Firefox profile, assuming that's the one you edited, run

sudo apparmor_parser -r /etc/apparmor.d/usr.bin.firefox