I understand there is a safer, more targeted way to troubleshoot AppArmor's possible contribution to an issue than completely stopping the service and tearing down AppArmor profiles. Can someone give me the details, and the advantages of the better approach?
Here's what I was thinking of (from https://wiki.ubuntu.com/DebuggingApparmor ) -- "complain mode" . This doesn't address the issue of relative merits or consequences of this versus other debugging methods.
When troubleshooting then, if there is something broken that appears to be related to a spooky permissions problem ('Hmm, looks like access control, but it's not a Unix permissions problem, or an NFS issue, or PAM issue, or a media mounting goof, etc. -- perhaps it's AppArmor.'), Kees Cook points out that best course of action is too check your system logs. Notably, per Kees Cook, "the output of