apctest

title: apctest(8)

summary: apcupsd(8) test program

text:
# apctest(8)

## NAME
apctest — apcupsd(8) test program

## SYNOPSIS
apctest

## DESCRIPTION
apctest is a program that enables the running of certain low-level tests to check the operation of the attached simple signalling American Power Conversion Corp (APC) UPS and to check that your apcupsd(8) configuration is correctly setup and can establish communication with the UPS.

For an APC UPS operating in APC smart protocol mode, apctest enables the reading and programming of the values of the UPS EEPROM configuration variables as well and the performing of a battery runtime calibration. It also provides a simple TTY chat mode which allows direct interaction with the UPS via the APC smart protocol. For details of this protocol and the available commands, refer to the detailed "APC Smart Protocol" section in the apcupsd manual.

IMPORTANT: Before running apctest

- Check that the UPSCABLE, UPSTYPE and DEVICE configuration directives in the apcupsd.conf(5) configuration file have been set appropriately; and

- Shutdown apcupsd if it is running. You cannot run both apcupsd and apctest at the same time.

When run, apctest displays a menu of options which are different depending on whether the UPS is connected to a USB port or to a serial port. For a serial port connection, there are two different menus depending on whether the UPS is operating in APC smart protocol mode or simple signalling mode - this also depends on which cable is used to connect to the UPS. If a simple signalling cable is used to connect to a Smart-UPS, the UPS will only be able to operate in simple signalling mode.

apctest saves a transcript of the session to the file apctest.out in the directory from which the program was called. Its content is useful for debugging purposes.

## USB PORT
When using a UPS connected to a USB port (eg Back-UPS RS 1500), the following menu options will appear:

### Option 1) Test kill UPS power
Performs a power down of the UPS into hibernate mode.

### Option 2) Perform self-test
Performs an immediate self-test (switches to battery power to do so).

### Option 3) Read last self-test result
Displays the last self-test result.

### Option 4) View/Change battery date
Displays the current battery replacement date and optionally allows you to change it - useful when the battery is replaced so that you can accurately keep track of its age.

### Option 5) View manufacturing date
Displays the date the UPS was manufactured.

### Option 6) View/Change alarm behavior
Sets the delay period before the UPS starts sounding its alarm when the utility power is lost.

### Option 7) View/Change sensitivity
Changes how sensitive the UPS is to the utility power quality and voltage fluctuations - (H)igh, (M)edium or (L)ow. The higher the sensitivity, the faster the UPS will switch to battery power or activate SmartBoost/SmartTrim (features that avoid using battery power provided the under/over voltage is within 12% of nominal). This setting should normally be set to High unless the UPS switches to battery power frequently, in which case a less sensitive setting will preserve UPS batteries... if the connected equipment can tolerate the power quality.

### Option 8) View/Change low transfer voltage
Sets the low voltage level at which the UPS switches to battery or activates SmartBoost.

### Option 9) View/Change high transfer voltage
Sets the high voltage level at which the UPS switches to battery or activates SmartTrim.

### Option 10) Perform battery calibration
This performs a battery runtime calibration. This can only be performed if your battery is charged to 100% of capacity. The runtime calibration discharges the UPS battery to approximately 25% of capacity. The exact percentage depends on the UPS model.

The advantage of doing this calibration is that the UPS will recalibrate the remaining runtime counter that it maintains and therefore report a more accurate estimated runtime. As batteries age, they tend to hold less charge, so the UPS's internal runtime counter may not be accurate after several years.

It is recommended that battery runtime calibration be performed annually. Performing it too often shortens the lifetime of the UPS batteries.

### Option 11) Test Alarm
This option will cause the UPS alarm beeper to sound for several seconds.

### Option 12) View/Change self-test interval
This option allows you to change the time interval between automatic UPS self-tests.

### Option Q) Quit
Exits from the program.

## SERIAL PORT (SMART PROTOCOL MODE)
When using a UPS operating in APC smart protocol mode (eg a Smart-UPS) the following menu options will appear:

### Option 1) Query the UPS for all known values
Selecting this option probes the UPS for all EEPROM configuration variable values known to apctest and displays them in rather raw format. This output can be useful for providing technical support if you are having problems with the behaviour of the UPS or apcupsd(8).

### Option 2) Perform a Battery Runtime Calibration
This performs a battery runtime calibration. This can only be performed if your battery is charged to 100% of capacity. The runtime calibration discharges the UPS battery to approximately 25% of capacity. The exact percentage depends on the UPS model. apctest can optionally abort the calibration if it detects that the battery charge is below 10%.

The advantage of doing this calibration is that the UPS will recalibrate the remaining runtime counter that it maintains and therefore report a more accurate estimated runtime. As batteries age, they tend to hold less charge, so the UPS's internal runtime counter may not be accurate after several years.

It is recommended that battery runtime calibration be performed annually. Performing it too often shortens the lifetime of the UPS batteries.

### Option 3) Abort Battery Calibration
This option aborts an in progress battery runtime calibration.

### Option 4) Monitor Battery Calibration progress
Allows restarting of the monitoring of a battery runtime calibration.

### Option 5) Program EEPROM
Allows the programming of the values of a Smart-UPS's EEPROM configuration variables.

Choosing this option presents a sub-menu of programming options which are detailed below.

Option 1) Print EEPROM values

Prints the value of all EEPROM configuration variables known to apctest.

Option 2) Change Battery date

Changes the battery date - useful when the battery is replaced so that you can accurately keep track of its age.

Option 3) Change UPS name

Changes the UPS name - use no more than 8 characters to name the UPS.

Option 4) Change sensitivity

Changes how sensitive the UPS is to the utility power quality and voltage fluctuations - (H)igh, (M)edium or (L)ow. The higher the sensitivity, the faster the UPS will switch to battery power or activate SmartBoost/SmartTrim (features that avoid using battery power provided the under/over voltage is within 12% of nominal). This setting should normally be set to High unless the UPS switches to battery power frequently, in which case a less sensitive setting will preserve UPS batteries... if the connected equipment can tolerate the power quality.

Option 5) Change alarm delay

Changes the delay period before the UPS starts sounding its alarm when the utility power is lost.

Option 6) Change low battery warning delay

Changes the remaining runtime minutes at which the UPS will send the low battery signal. When the UPS internally calculates that the specified number of minutes remains before battery power will be exhausted, it sends the low battery warning.

Option 7) Change wakeup delay

Changes the delay before the UPS restores power to connected equipment when the utility power returns after shutting down in hibernate mode.

Option 8) Change shutdown delay

Changes the delay for which the UPS waits before shutting off power to the connected equipment after being commanded to power down in hibernate mode.

Option 9) Change low transfer voltage

Changes the low voltage level at which the UPS switches to battery or activates SmartBoost.

Option 10) Change high transfer voltage

Changes the high voltage level at which the UPS switches to battery or activates SmartTrim.

Option 11) Change battery return threshold percent

Changes the battery charge percentage required after power down in hibernate mode before to the UPS will restore power to connected equipment on the return of utility power.

Option 12) Change output voltage when on batteries

Changes the nominal voltage output when the UPS is running on battery power.

Option 13) Change the self test interval

Changes or disables the automatic self-test interval.

Option 14) Set EEPROM with configuration file values

This option allows the bulk programming of the EEPROM configuration variables from the values contained in the /etc/apcupsd.conf configuration file. Refer to the "APCTEST EEPROM CONFIGURATION DIRECTIVES" section of the man page for apcupsd.conf(5)

Option 15) Quit

This option exits back to the previous (main) menu.

### Option 6) Enter TTY mode communicating with UPS
This option allows direct interaction with the attached UPS using the APC smart protocol commands.

WARNING: Take special care what commands you enter because it is possible to cause the UPS to suddenly shutdown or, in the worst case, modify the UPS in such a way as to permanently disable it. Do NOT experiment with unknown or unsupported commands. Caveat Utilitor!

### Option 7) Quit
Exits from the program.

## SERIAL PORT (SIMPLE SIGNALLING MODE)
When using an APC UPS operating in simple signalling mode the following menu options will appear:

### Option 1) Test 1 - normal mode
The test result depends on the model of UPS and type of cable being used. Refer to the "Using apctest on Serial-Line UPSses" section in the apcupsd manual for details.

### Option 2) Test 2 - no cable
The test result depends on the model of UPS and type of cable being used. Refer to the "Using apctest on Serial-Line UPSses" section in the apcupsd manual for details.

### Option 3) Test 3 - no power
The test result depends on the model of UPS and type of cable being used. Refer to the "Using apctest on Serial-Line UPSses" section in the apcupsd manual for details.

### Option 4) Test 4 - low battery (requires Test 3 first)
The test result depends on the model of UPS and type of cable being used. Refer to the "Using apctest on Serial-Line UPSses" section in the apcupsd manual for details.

### Option 5) Test 5 - battery exhausted
The test result depends on the model of UPS and type of cable being used. Refer to the "Using apctest on Serial-Line UPSses" section in the apcupsd manual for details.

### Option 6) Test 6 - kill UPS power
The test result depends on the model of UPS and type of cable being used. Refer to the "Using apctest on Serial-Line UPSses" section in the apcupsd manual for details.

### Option 7) Test 7 - run tests 1 through 5
This option has apctest guess which cable should be used with the attached UPS.

### Option 9) Quit
Exits from the program.

## FILES
/etc/apcupsd/apcupsd.conf default configuration file

apctest.out transcript of the apctest session

## SEE ALSO
apcupsd.conf(5), apcupsd(8).

The HTML apcupsd manual installed on your system or available online at http://www.apcupsd.org/

## AUTHORS

### This page
Trevor Roydhouse (current)

Robert Huff

### Software

Adam Kropelin (current Project Manager and Code Maintainer)

Kern Sibbald (former Project Manager and Code Maintainer)

Riccardo Facchetti (former Project Manager and Code Maintainer)

Andre M. Hedrick (Project Founder and former Code Maintainer)

### Contributors
An enormous number of users who have devoted their time and energy to this project -- thanks.


apcupsd

package: apcupsd

title: apcupsd(8)

summary: a daemon for controlling most APC UPSes

text:
# apcupsd(8)

## NAME
apcupsd — a daemon for controlling most APC UPSes

## SYNOPSIS
apcupsd

[-b] [-d level | --debug level] [-f file | --config-file file] [-P file | --pid-file file] [-p | --kill-on-powerfail | -t | --term-on-powerfail] [-R]

apcupsd

[-k | --killpower | --hibernate | -o | --power-off]

apcupsd

[-h | --help]

apcupsd

[-V | --version]

## DESCRIPTION
The apcupsd daemon controls the operation of most American Power Conversion Corp (APC) UPSes. During a power failure, apcupsd informs users about the loss of utility power and that a shutdown may occur. If utility power is not restored, a system shutdown will follow when the battery is exhausted, a specified timeout expires, a specified battery charge percentage is reached, or a specified battery runtime (based on internal UPS calculations and determined by power consumption rates) expires. If the utility power is restored before one of the these shutdown conditions is met, apcupsd will inform users of this and the shutdown will generally be cancelled. Refer to the Implementation Notes section below for situations in which the shutdown may not be cancelled.

The meaning of the command line options is as follows:

-b

Run in the foreground, do not detach and become a daemon.

-d level --debug level

Set debugging output level where level is a number greater than zero.

-f file --config-file file

Load the specified configuration file. The default configuration file is /etc/apcupsd/apcupsd.conf. It must be changed when running more than one copy of apcupsd on the same computer to control multiple UPSes.

-k | --killpower | --hibernate

Power down the UPS in hibernate mode after a 10 second delay. This option is normally only used by apcupsd itself to power down the UPS after a system shutdown has almost completed. In hibernate mode, the UPS will again supply power to the system when the utility power returns.

-o | --power-off

Power down UPS completely. The UPS will not supply power to the system when the utility power returns.

-P file --pid-file file

Create the specified process ID file. The default is /var/run/apcupsd.pid. It must be changed when running more than one copy of apcupsd on the same computer to control multiple UPSes.

-p --kill-on-powerfail

apcupsd commands the UPS to power down in hibernate mode just before apcupsd starts the system shutdown. This relies on the grace shutdown delay of a Smart-UPS being long enough to allow the system to shutdown completely before the UPS shuts off the power to the system and goes into hibernate mode. This shutdown grace delay is a programmable value stored in a Smart-UPS EEPROM which can be changed using apctest(8). In hibernate mode, the UPS will again supply power to the system when the utility power returns. Refer to apcupsd.conf(5) for an alternative method using the KILLDELAY configuration directive and the only method available when using a Back-UPS or other UPS operating in simple signalling mode.

-t --term-on-powerfail

apcupsd exits immediately when it issues the system shutdown command. This behaviour is useful for those systems where it is not possible to insert apcupsd commands in a halt script to issue the killpower command. Without this option, apcupsd will wait for the SIGTERM signal from the system shutdown process before exiting.

-R

Put a UPS which runs in smart signalling mode by default (eg a Smart-UPS) into simple signalling mode.

-v --version

Prints the apcupsd version number and the program help.

-h --help

Prints the program help.

The apcupsd daemon supports a networking mode called Network Information Server (NIS) -- not related to Sun's NIS/YP -- in which the daemon serves status and event information to clients over a network. See the "Running The Network Information Server" section of the apcupsd manual for more information and configuration details on this mode.

The apcupsd daemon also supports a Smart-UPS in SNMP mode provided an APC Web/SNMP or APC PowerNet SNMP card is installed in the UPS's SmartSlot. For more information and configuration details on this mode, refer to the "Support for SNMP UPSes" section of the apcupsd manual.

## IMPLEMENTATION NOTES
The shutdown is made by calls to the script /etc/apcupsd/apccontrol by the apcupsd daemon. Consequently, no changes to /etc/inittab are necessary on Linux as there is no communication between the daemon and the init(1) process. Installation of the daemon modifies the halt script so that at the end of the shutdown process, the daemon will be re-executed to power off the UPS in hibernate mode.

On some operating systems (eg FreeBSD) there is no halt script so apccontrol must be modified to cause the daemon to power off the UPS after a delay. Alternatives are to use the --kill-on-powerfail command on the apcupsd command line or refer to apcupsd.conf(5) for details of the KILLDELAY configuration directive.

## CONFIGURATION
It will almost certainly be necessary to customise the configuration information in the /etc/apcupsd/apcupsd.conf configuration file to suit your configuration and desired UPS behaviour.

For information on the configuration directives and the format of the configuration file, refer to apcupsd.conf(5).

## EVENTS
apcupsd generates events when certain conditions occur. These events are sent to the system log and, optionally, to the temporary events file (/var/log/apcupsd.events). They also generate a call to the /etc/apcupsd/apccontrol script which in turn will call any custom scripts placed in the /etc/apcupsd directory which may override apccontrol's default behaviour. For details of the events and customising apccontrol's behaviour, refer to apccontrol(8).

## DATA FILE FORMAT
If the DATATIME configuration directive is set to non-zero, apcupsd will log a data record at the interval defined by the DATATIME directive. This data record is in a format similar to the APC PowerChute software data file format.

## STATUS REPORT FORMAT
The status report output format is simple ASCII. Generally there is a single piece of information on each line of output. The content varies based on the model of UPS being used and, in some cases, the firmware version. This status report is also optionally written the the /etc/apcupsd/apcupsd.status file. Refer to apcaccess(8) for full details of the status report output.

## FILES
/etc/apcupsd/apcupsd.conf default configuration file

/var/run/apcupsd.pid default process ID file

/var/log/apcupsd.status optional status file

/var/log/apcupsd.events default events file

## SEE ALSO
apcupsd.conf(5), apcaccess(8), apccontrol(8), apctest(8).

The HTML apcupsd manual installed on your system or available online at http://www.apcupsd.org/

## AUTHORS

### This page
Trevor Roydhouse (current)

Andre M. Hedrick

Christopher J. Reimer

### Software

Adam Kropelin (current Project Manager and Code Maintainer)

Kern Sibbald (former Project Manager and Code Maintainer)

Riccardo Facchetti (former Project Manager and Code Maintainer)

Andre M. Hedrick (Project Founder and former Code Maintainer)

### Contributors
An enormous number of users who have devoted their time and energy to this project -- thanks.

branch: sisyphus


apgd

package: apg-daemon

title: apgd(8)

text:
# apgd(8)

## NAME
apgd - server that generates several random passwords

## SYNOPSIS
apgd [-a algorithm] [-M mode] [-E char_string] [-n num_of_pass] [-m min_pass_len] [-x max_pass_len] [-r dictfile] [-b filter_file] [-p min_substr_len] [-t] [-l]

## DESCRIPTION
apgd program is a server that supports Password Generation Protocol described in RFC972. It uses several password generation algorithms (currently two) and a built-in pseudo random number generator.

apgd is normally invoked by the Internet superserver (see inetd (8)) for requests to connect to the pwdgen port (pwdgen port is 129 according to RFC1700 ) as indicated by the /etc/services file (see services (5)).

Default algorithm is pronounceable password generation algorithm designed by Morrie Gasser and described in "A Random Word Generator For Pronounceable Passwords" National Technical Information Service (NTIS) AD-A-017676. The original paper is very old and had never been put online, so I have to use NIST implementation described in FIPS-181.

Another algorithm is simple random character generation algorithm, but it uses four user-defined symbol sets to produce random password. It means that user can choose type of symbols that should appear in password. Symbol sets are: numeric symbol set (0,...,9) , capital letters symbol set (A,...,Z) , small letters symbol set (a,...,z) and special symbols symbol set (#,@,!,...).

Built-in pseudo random number generator is an implementation of algorithm described in Appendix C of ANSI X9.17 or RFC1750 with exception that it uses CAST or SHA-1 instead of Triple DES. It uses local time with precision of microseconds (see gettimeofday(2)) and /dev/random (if available) to produce initial random seed.

apgd also have the ability to check generated password quality using dictionary. You can use this ability if you specify command-line option -r dictfile or -b filtername where dictfile is dictionary file name and filtername is the name of Bloom filter file. In that dictionary you may place words (one per line) that should not appear as generated passwords. For example: user names common words, etc. You even can use one of the dictionaries that come with dictionary password crackers. Bloom filter file should be created with apgbfm(1) utility included in apg distribution. In future releases I plan to implement some other techniques to check passwords just to make life easier.

apgd has the ability log user password generation activity and internal debug information. It does this using

facility = daemon

priority = info for user password generation activity logging

priority = debug for internal debug information

See the syslogd(8) and syslog.conf(5) man pages for information on how to configure your syslog daemon.

## OPTIONS

### Password generation modes options
-a algorithm

use algorithm for password generation.

0 - (default) pronounceable password generation

1 - random character password generation

-n num_of_pass

generate num_of_pass number of passwords. Default is 6.

-m min_pass_len

generate password with minimum length min_pass_len. If min_pass_len > max_pass_len then max_pass_len = min_pass_len. Default minimum password length is 8.

-x max_pass_len

generate password with maximum length max_pass_len If min_pass_len > max_pass_len then max_pass_len = min_pass_len. Default maximum password length is 10.

-M mode

Use symbolsets specified with mode for password generation. mode is a text string consisting of characters S, s, N, n, C, c, L, l. Where:

S

generator must use special symbol set for every generated password.

s

generator should use special symbol set for password generation.

N

generator must use numeral symbol set for every generated password.

n

generator should use numeral symbol set for password generation.

C

generator must use capital symbol set for every generated password.

c

generator should use capital symbol set for password generation.

L

generator must use small letters symbol set for every generated password (always present if pronounceable password generation algorithm is used).

l

generator should use small letters symbol set for password generation.

R,r

not supported any more. Use -E char_string option instead.

mode can not be more than 4 characters in length. Note:

Usage of L, M, N, C will slow down password generation process.

Examples:

-M sncl or -M SNCL or -M Cn

-E char_string

exclude characters in char_string from password generation process (in pronounceable password generation mode you can not exclude small letters). To include special symbols that can be recognized by shell (apostrophe, quotes, dollar sign, etc.) in char_string use the backslashed versions.

Examples:

Command apgd -a 1 -M n -n 3 -m 8 -e 23456789 will generate a set of passwords that will look like this

10100110

01111000

11011101

Command apgd -a 1 -M nc -n 3 -m 26 -e GHIJKLMNOPQRSTUVWXYZ will generate a set of passwords that will look like this

16A1653CD4DE5E7BD9584A3476

C8F78E06944AFD57FB9CB882BC

8C8DF37CD792D36D056BBD5002

### Password quality control options
-r dictfile

check generated passwords for their appearance in dictfile

-b filter_file

check generated passwords for their appearance in filter_file. filter_file should be created with apgbfm(1) utility.

-p min_substr_len

this option tells apg(1) to check every substring of the generated password for appearance in filter_file. If any of such substrings would be found in the filter_file then generated password would be rejected and apg(1) will generate another one. min_substr_len is specifies minimum substring length to check. This option is active only if -b option is defined.

### Password output options
-l

spell genetated passwords. Useful when you want to read generated password by telephone.

WARNING: Think twice before read your password by phone.

-t

print pronunciation for generated pronounceable password

## DEFAULT OPTIONS
apgd -a 0 -M sncl -n 6 -x 10 -m 8 (new style)

## EXIT CODE
On successful completion of its task, apgd will complete with exit code 0. An exit code of -1 indicates an error occurred. Textual errors are written to the syslogd (8).

## DIAGNOSTICS
All textual info is written to the syslogd(8).

## FILES
None.

## BUGS
None. If you've found one, please send bug description to the author.

## SEE ALSO
apg(1), apgbfm(1)

## AUTHOR
Adel I. Mirzazhanov, <a-del@iname.com>

Project home page: http://www.adel.nursat.kz/apg/


aa-audit

package: apparmor

title: aa-audit(8)

text:
# aa-audit(8)

## NAME
aa-audit - set an AppArmor security profile to audit mode.

## SYNOPSIS
aa-audit <executable> [<executable> ...] [-d /path/to/profiles] [--no-reload] [-r]

## OPTIONS
-d --dir /path/to/profiles

```
   Specifies where to look for the AppArmor security profile set.
   Defaults to /etc/apparmor.d.
```

--no-reload

Do not reload the profile after modifying it.

-r --remove

```
   Removes the audit mode for the profile.
```

## DESCRIPTION
aa-audit is used to set one or more profiles to audit mode. In this mode security policy is enforced and all access (successes and failures) are logged to the system log.

The --remove option can be used to remove the audit mode for the profile.

## BUGS
If you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7), apparmor.d(5), aa-enforce(1), aa-complain(1), aa-disable(1), aa_change_hat(2), and <https://wiki.apparmor.net>.


aa-autodep

title: aa-autodep(8)

text:
# aa-autodep(8)

## NAME
aa-autodep - guess basic AppArmor profile requirements

## SYNOPSIS
aa-autodep <executable> [<executable> ...] [-d /path/to/profiles] [-f]

## OPTIONS
-d --dir /path/to/profiles

```
   Specifies where to look for the AppArmor security profile set.
   Defaults to /etc/apparmor.d.
```

-f --force

```
   Overwrites any existing AppArmor profile for the executable with the generated minimal AppArmor profile.
```

## DESCRIPTION
aa-autodep is used to generate a minimal AppArmor profile for a set of executables. This program will generate a profile for binary executable as well as interpreted script programs. At a minimum aa-autodep will provide a base profile containing a base include directive which includes basic profile entries needed by most programs.

The --force option will overwrite any existing profile for the executable with the newly generated minimal AppArmor profile.

## BUGS
This program does not perform full static analysis of executables, so the profiles generated are necessarily incomplete. If you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7), apparmor.d(5), aa-complain(1), aa-enforce(1), aa-disable(1), aa_change_hat(2), and <https://wiki.apparmor.net>.


aa-cleanprof

title: aa-cleanprof(8)

text:
# aa-cleanprof(8)

## NAME
aa-cleanprof - clean an existing AppArmor security profile.

## SYNOPSIS
aa-cleanprof <executable> [<executable> ...] [-d /path/to/profiles] [--no-reload] [-s]

## OPTIONS
-d --dir /path/to/profiles

```
   Specifies where to look for the AppArmor security profile set.
   Defaults to /etc/apparmor.d.
```

--no-reload

Do not reload the profile after modifying it.

-s --silent

```
   Silently overwrites the profile without user prompt.
```

## DESCRIPTION
aa-cleanprof is used to perform a cleanup on one or more profiles. The tool removes any existing superfluous rules (rules that are covered under an include or another rule), reorders the rules to group similar rules together and removes all comments from the file.

## BUGS
If you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7), apparmor.d(5), aa-enforce(1), aa-complain(1), aa-disable(1), aa_change_hat(2), and <https://wiki.apparmor.net>.


aa-complain

title: aa-complain(8)

text:
# aa-complain(8)

## NAME
aa-complain - set an AppArmor security profile to complain mode.

## SYNOPSIS
aa-complain <executable> [<executable> ...] [-d /path/to/profiles] [--no-reload]

## OPTIONS
-d --dir /path/to/profiles

```
   Specifies where to look for the AppArmor security profile set.
   Defaults to /etc/apparmor.d.
```

--no-reload

Do not reload the profile after modifying it.

## DESCRIPTION
aa-complain is used to set the enforcement mode for one or more profiles to complain mode. In this mode security policy is not enforced but rather access violations are logged to the system log.

Note that 'deny' rules will be enforced even in complain mode.

## BUGS
If you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7), apparmor.d(5), aa-enforce(1), aa-disable(1), aa_change_hat(2), and <https://wiki.apparmor.net>.


aa-decode

title: aa-decode(8)

summary: decode hex\-encoded in AppArmor log files

text:
# aa-decode(8)

## NAME
aa-decode - decode hex-encoded in AppArmor log files

## SYNOPSIS
aa-decode [option] <HEX STRING>

## DESCRIPTION
aa-decode will decode hex-encoded strings as seen in AppArmor log output. It will also take an audit log on standard input and convert any hex-encoded AppArmor log entries and display them on standard output.

## OPTIONS
--help

displays a short usage statement.

## EXAMPLES

```
  $ aa-decode 2F746D702F666F6F20626172
  Decoded: /tmp/foo bar
  $ cat /var/log/kern.log | aa-decode
  ... denied_mask="r::" fsuid=1000 ouid=1000 name=/tmp/foo bar
```

## BUGS
None. Please report any you find to gitlab at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7)


aa-disable

title: aa-disable(8)

summary: disable an AppArmor security profile

text:
# aa-disable(8)

## NAME
aa-disable - disable an AppArmor security profile

## SYNOPSIS
aa-disable <executable> [<executable> ...] [-d /path/to/profiles] [--no-reload] [-r]

## OPTIONS
-d --dir /path/to/profiles

```
   Specifies where to look for the AppArmor security profile set.
   Defaults to /etc/apparmor.d.
```

--no-reload

Do not unreload the profile after modifying it.

## DESCRIPTION
aa-disable is used to disable one or more profiles. This command will unload the profile from the kernel and prevent the profile from being loaded on AppArmor startup. The aa-enforce and aa-complain utilities may be used to to change this behavior.

## BUGS
If you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7), apparmor.d(5), aa-enforce(1), aa-complain(1), aa_change_hat(2), and <https://wiki.apparmor.net>.


aa-easyprof

title: aa-easyprof(8)

summary: AppArmor profile generation made easy.

text:
# aa-easyprof(8)

## NAME
aa-easyprof - AppArmor profile generation made easy.

## SYNOPSIS
aa-easyprof [option] <path to binary>

## DESCRIPTION
aa-easyprof provides an easy to use interface for AppArmor policy generation. aa-easyprof supports the use of templates and policy groups to quickly profile an application. Please note that while this tool can help with policy generation, its utility is dependent on the quality of the templates, policy groups and abstractions used. Also, this tool may create policy which is less restricted than creating policy by hand or with aa-genprof and aa-logprof.

## OPTIONS
aa-easyprof accepts the following arguments:

-t TEMPLATE, --template=TEMPLATE

Specify which template to use. May specify either a system template from /usr/share/apparmor/easyprof/templates or a filename for the template to use. If not specified, use /usr/share/apparmor/easyprof/templates/default.

-p POLICYGROUPS, --policy-groups=POLICYGROUPS

Specify POLICY as a comma-separated list of policy groups. See --list-templates for supported policy groups. The available policy groups are in /usr/share/apparmor/easyprof/policy. Policy groups are simply groupings of AppArmor rules or policies. They are similar to AppArmor abstractions, but usually encompass more policy rules.

--parser PATH

Specify the PATH of the apparmor_parser binary to use when verifying policy. If this option is not specified, aa-easyprof will attempt to locate the path starting with /sbin/apparmor_parser.

-a ABSTRACTIONS, --abstractions=ABSTRACTIONS

Specify ABSTRACTIONS as a comma-separated list of AppArmor abstractions. It is usually recommended you use policy groups instead, but this is provided as a convenience. AppArmor abstractions are located in /etc/apparmor.d/abstractions. See apparmor.d(5) for details.

-b PATH, --base=PATH

Set the base PATH for resolving abstractions specified by --abstractions. See the same option in apparmor_parser(8) for details.

-I PATH, --Include=PATH

Add PATH to the search paths used for resolving abstractions specified by --abstractions. See the same option in apparmor_parser(8) for details.

-r PATH, --read-path=PATH

Specify a PATH to allow owner reads. May be specified multiple times. If the PATH ends in a '/', then PATH is treated as a directory and reads are allowed to all files under this directory. Can optionally use '/*' at the end of the PATH to only allow reads to files directly in PATH.

-w PATH, --write-dir=PATH

Like --read-path but also allow owner writes in additions to reads.

-n NAME, --name=NAME

Specify NAME of policy. If not specified, NAME is set to the name of the binary. The NAME of the policy is typically only used for profile meta data and does not specify the AppArmor profile name.

--profile-name=PROFILENAME

Specify the AppArmor profile name. When set, uses 'profile PROFILENAME' in the profile. When set and specifying a binary, uses 'profile PROFILENAME BINARY' in the profile. If not set, the binary will be used as the profile name and profile attachment.

--template-var="@{VAR}=VALUE"

Set VAR to VALUE in the resulting policy. This typically only makes sense if the specified template uses this value. May be specified multiple times.

--list-templates

List available templates.

--show-template

Display template specified with --template.

--templates-dir=PATH

Use PATH instead of system templates directory.

--include-templates-dir=PATH

Include PATH when searching for templates in addition to the system templates directory (or the one specified with --templates-dir). System templates will match before those in PATH.

--list-policy-groups

List available policy groups.

--show-policy-group

Display policy groups specified with --policy-groups.

--policy-groups-dir=PATH

Use PATH instead of system policy-groups directory.

--include-policy-groups-dir=PATH

Include PATH when searching for policy groups in addition to the system policy-groups directory (or the one specified with --policy-groups-dir). System policy-groups will match before those in PATH.

--policy-version=VERSION

Must be used with --policy-vendor and is used to specify the version of policy groups and templates. When specified, aa-easyprof looks for the subdirectory VENDOR/VERSION within the policy-groups and templates directory. The specified version must be a positive decimal number compatible with the JSON Number type. Eg, when using:

```
    $ aa-easyprof --templates-dir=/usr/share/apparmor/easyprof/templates \
                  --policy-groups-dir=/usr/share/apparmor/easyprof/policygroups \
                  --policy-vendor="foo" \
                  --policy-version=1.0

```

Then /usr/share/apparmor/easyprof/templates/foo/1.0 will be searched for templates and /usr/share/apparmor/easyprof/policygroups/foo/1.0 for policy groups.

--policy-vendor=VENDOR

Must be used with --policy-version and is used to specify the vendor for policy groups and templates. See --policy-version for more information.

--author

Specify author of the policy.

--copyright

Specify copyright of the policy.

--comment

Specify comment for the policy.

-m MANIFEST, --manifest=MANIFEST

aa-easyprof also supports using a JSON manifest file for specifying options related to policy. Unlike command line arguments, the JSON file may specify multiple profiles. The structure of the JSON is:

```
  {
    "security": {
      "profiles": {
        "<profile name 1>": {
          ... attributes specific to this profile ...
        },
        "<profile name 2>": {
          ...
        }
      }
    }
  }

```

Each profile JSON object (ie, everything under a profile name) may specify any fields related to policy. The "security" JSON container object is optional and may be omitted. An example manifest file demonstrating all fields is:

```
  {
    "security": {
      "profiles": {
        "com.example.foo": {
          "abstractions": [
            "audio",
            "gnome"
          ],
          "author": "Your Name",
          "binary": "/opt/foo/**",
          "comment": "Unstructured single-line comment",
          "copyright": "Unstructured single-line copyright statement",
          "name": "My Foo App",
          "policy_groups": [
            "networking",
            "user-application"
          ],
          "policy_vendor": "somevendor",
          "policy_version": 1.0,
          "read_path": [
            "/tmp/foo_r",
            "/tmp/bar_r/"
          ],
          "template": "user-application",
          "template_variables": {
            "APPNAME": "foo",
            "VAR1": "bar",
            "VAR2": "baz"
          },
          "write_path": [
            "/tmp/foo_w",
            "/tmp/bar_w/"
          ]
        }
      }
    }
  }

```

A manifest file does not have to include all the fields. Eg, a manifest file for an Ubuntu SDK application might be:

```
  {
    "security": {
      "profiles": {
        "com.ubuntu.developer.myusername.MyCoolApp": {
          "policy_groups": [
            "networking",
            "online-accounts"
          ],
          "policy_vendor": "ubuntu",
          "policy_version": 1.0,
          "template": "ubuntu-sdk",
          "template_variables": {
            "APPNAME": "MyCoolApp",
            "APPVERSION": "0.1.2"
          }
        }
      }
    }
  }

```

--verify-manifest

When used with --manifest, warn about potentially unsafe definitions in the manifest file.

--output-format=FORMAT

Specify either text (default if unspecified) for AppArmor policy output or json for JSON manifest format.

--output-directory=DIR

Specify output directory for profile. If unspecified, policy is sent to stdout.

## EXAMPLES
Example usage for a program named 'foo' which is installed in /opt/foo:

```
    $ aa-easyprof --template=user-application --template-var="@{APPNAME}=foo" \
                  --policy-groups=opt-application,user-application \
                  /opt/foo/bin/FooApp
```

When using a manifest file:

```
    $ aa-easyprof --manifest=manifest.json
```

To output a manifest file based on aa-easyprof arguments:

```
    $ aa-easyprof --output-format=json \
                  --author="Your Name" \
                  --comment="Unstructured single-line comment" \
                  --copyright="Unstructured single-line copyright statement" \
                  --name="My Foo App" \
                  --profile-name="com.example.foo" \
                  --template="user-application" \
                  --policy-groups="user-application,networking" \
                  --abstractions="audio,gnome" \
                  --read-path="/tmp/foo_r" \
                  --read-path="/tmp/bar_r/" \
                  --write-path="/tmp/foo_w" \
                  --write-path=/tmp/bar_w/ \
                  --template-var="@{APPNAME}=foo" \
                  --template-var="@{VAR1}=bar" \
                  --template-var="@{VAR2}=baz" \
                  "/opt/foo/**"
```

## BUGS
If you find any additional bugs, please report them to GitLab at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7) apparmor.d(5)


aa-enforce

title: aa-enforce(8)

text:
# aa-enforce(8)

## NAME
aa-enforce - set an AppArmor security profile to enforce mode from being disabled or complain mode.

## SYNOPSIS
aa-enforce <executable> [<executable> ...] [-d /path/to/profiles] [--no-reload]

## OPTIONS
-d --dir / path/to/profiles

```
   Specifies where to look for the AppArmor security profile set.
   Defaults to /etc/apparmor.d.
```

--no-reload

Do not reload the profile after modifying it.

## DESCRIPTION
aa-enforce is used to set one or more profiles to enforce mode. This command is only relevant in conjunction with the aa-complain utility which sets a profile to complain mode and the aa-disable utility which unloads and disables a profile. The default mode for a security policy is enforce and the aa-complain utility must be run to change this behavior.

## BUGS
If you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7), apparmor.d(5), aa-complain(1), aa-disable(1), aa_change_hat(2), and <https://wiki.apparmor.net>.


aa-genprof

title: aa-genprof(8)

summary: profile generation utility for AppArmor

text:
# aa-genprof(8)

## NAME
aa-genprof - profile generation utility for AppArmor

## SYNOPSIS
aa-genprof <executable> [-d /path/to/profiles] [-f /path/to/logfile]

## OPTIONS
-d --dir /path/to/profiles

```
   Specifies where to look for the AppArmor security profile set.
   Defaults to /etc/apparmor.d.
```

-f --file /path/to/logfile

```
        Specifies the location of logfile.
        Default locations are read from F</etc/apparmor/logprof.conf>.
        Typical defaults are:
                 /var/log/audit/audit.log
                 /var/log/syslog
                 /var/log/messages
```

## DESCRIPTION
When running aa-genprof, you must specify a program to profile. If the specified program is not a fully-qualified path, aa-genprof will search $PATH in order to find the program.

If a profile does not exist for the program, aa-genprof will create one using aa-autodep(1).

Genprof will then:

```
   - set the profile to complain mode
   - write a mark to the system log
   - instruct the user to start the application to
     be profiled in another window and exercise its functionality
```

It then presents the user with two options, (S)can system log for entries to add to profile and (F)inish.

If the user selects (S)can or hits return, aa-genprof will parse the complain mode logs and iterate through generated violations using aa-logprof(1).

After the user finishes selecting profile entries based on violations that were detected during the program execution, aa-genprof will reload the updated profiles in complain mode and again prompt the user for (S)can and (F)inish. This cycle can then be repeated as necessary until all application functionality has been exercised without generating access violations.

When the user eventually hits (F)inish, aa-genprof will set the main profile, and any other profiles that were generated, into enforce mode and exit.

## BUGS
If you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7), apparmor.d(5), aa-enforce(1), aa-complain(1), aa-disable(1), aa_change_hat(2), aa-logprof(1), logprof.conf(5), and <https://wiki.apparmor.net>.


aa-load

title: aa-load(8)

text:
# aa-load(8)

## NAME
aa-load - load precompiled AppArmor policy from cache location(s)

## SYNOPSIS
aa-load [options] (cache file|cache dir|cache base dir)+

## DESCRIPTION
aa-load loads precompiled AppArmor policy from the specified locations.

## OPTIONS
aa-load accepts the following arguments:

-f, --force

Force aa-load to load a policy even if its abi does not match the kernel abi.

-d, --debug

Display debug messages.

-v, --verbose

Display progress and error messages.

-n, --dry-run

Do not actually load the specified policy/policies into the kernel.

-h, --help

Display a brief usage guide.

## EXIT STATUS
Upon exiting, aa-load returns 0 upon success and 1 upon an error loading the precompiled policy.

## BUGS
If you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7), apparmor.d(5), apparmor_parser(8), and <https://wiki.apparmor.net>.


aa-logprof

title: aa-logprof(8)

text:
# aa-logprof(8)

## NAME
aa-logprof - utility for updating AppArmor security profiles

## SYNOPSIS
aa-logprof [-d /path/to/profiles] [-f /path/to/logfile] [-m <mark in logfile>]

## OPTIONS
-d --dir /path/to/profiles

```
   Specifies where to look for the AppArmor security profile set.
   Defaults to /etc/apparmor.d.
```

-f --file /path/to/logfile

```
    Specifies the location of logfile that contains AppArmor security events.
        Default locations are read from F</etc/apparmor/logprof.conf>.
        Typical defaults are:
                 /var/log/audit/audit.log
                 /var/log/syslog
                 /var/log/messages
```

-m --logmark "mark"

```
   aa-logprof will ignore all events in the system log before the
   specified mark is seen.  If the mark contains spaces, it must
   be surrounded with quotes to work correctly.
```

## DESCRIPTION
aa-logprof is an interactive tool used to review AppArmor generated messages and update AppArmor security profiles.

Running aa-logprof will scan the log file and if there are new AppArmor events that are not covered by the existing profile set, the user will be prompted with suggested modifications to augment the profile.

When aa-logprof exits profile changes are saved to disk. If AppArmor is running, the updated profiles are reloaded and if any processes that generated AppArmor events are still running in the null-complain-profile, those processes are set to run under their proper profiles.

### Responding to AppArmor Events
aa-logprof will generate a list of suggested profile changes that the user can choose from, or they can create their own, to modify the permission set of the profile so that the generated access violation will not re-occur.

The user is then presented with info about the access including profile, path, old mode if there was a previous entry in the profile for this path, new mode, the suggestion list, and given these options:

```
   (A)llow, (D)eny, (I)gnore, (N)ew, (G)lob last piece, (Q)uit
```

If the AppArmor profile was in complain mode when the event was generated, the default for this option is (A)llow, otherwise, it's (D)eny.

The (D)eny option adds a "deny" rule to the AppArmor profile, which silences logging.

The (I)gnore option allows user to ignore the event, without making any changes to the AppArmor profile.

The suggestion list is presented as a numbered list with includes at the top, the literal path in the middle, and the suggested globs at the bottom. If any globs are being suggested, the shortest glob is the selected option, otherwise, the literal path is selected. Picking includes from the list must be done manually.

Hitting a numbered key will change the selected option to the corresponding numbered entry in the list.

If the user selects (N)ew, they'll be prompted to enter their own globbed entry to match the path. If the user-entered glob does not match the path for this event, they'll be informed and have the option to fix it.

If the user selects (G)lob last piece then, taking the currently selected option, aa-logprof will remove the last path element and replace it with /*.

If the last path element already was /*, aa-logprof will go up a directory level and replace it with /**.

This new globbed entry is then added to the suggestion list and marked as the selected option.

So /usr/share/themes/foo/bar/baz.gif can be turned into /usr/share/themes/** by hitting "g" three times.

If the user selects (A)llow, aa-logprof will take the current selection and add it to the profile, deleting other entries in the profile that are matched by the new entry.

Adding r access to /usr/share/themes/** would delete an entry for r access to /usr/share/themes/foo/*.gif if it exists in the profile.

If (Q)uit is selected at this point, aa-logprof will ignore all new pending accesses.

After all of the accesses have been handled, logrof will write all updated profiles to the disk and reload them if AppArmor is running.

### New Process (Execution) Events
If there are unhandled x accesses generated by the execve(2) of a new process, aa-logprof will display the parent profile and the target program that's being executed and prompt the user to select an execute modifier. These modifiers will allow a choice for the target to: have it's own profile (px), inherit the parent's profile (ix), run unconstrained (ux), or deny access for the target. See apparmor.d(5) for details.

If there is a corresponding entry for the target in the qualifiers section of /etc/apparmor/logprof.conf, the presented list will contain only the allowed modes.

The default option for this question is selected using this logic--

```
  # if px mode is allowed and profile exists for the target
  #   px is default.
  # else if ix mode is allowed
  #   ix is default
  # else
  #   deny is default
```

aa-logprof will never suggest "ux" as the default.

### ChangeHat Events
If unknown aa_change_hat(2) events are found, the user is prompted to add a new hat, if the events should go into the default hat for this profile based on the corresponding entry in the defaulthat section of logprof.conf, or if the following events that run under that hat should be denied altogether.

### Capability Events
If there are capability accesses, the user is shown each capability access and asked if the capability should be allowed, denied, or if the user wants to quit. See capability(7) for details.

## BUGS
If you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
klogd(8), auditd(8), apparmor(7), apparmor.d(5), aa_change_hat(2), logprof.conf(5), aa-genprof(1), aa-enforce(1), aa-complain(1), aa-disable(1), and <https://wiki.apparmor.net>.


aa-mergeprof

title: aa-mergeprof(8)

summary: merge AppArmor security profiles.

text:
# aa-mergeprof(8)

## NAME
aa-mergeprof - merge AppArmor security profiles.

## SYNOPSIS
aa-mergeprof file [file ...] [-d /path/to/profiles]

## OPTIONS
file

```
   One or more files containing profiles to merge into the profile directory (see -d).
```

-d --dir /path/to/profiles

```
   Specifies the target directory for the merged AppArmor security profile set.
   Defaults to /etc/apparmor.d.
```

## DESCRIPTION
aa-mergeprof

## BUGS
If you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7), apparmor.d(5), aa_change_hat(2), aa-genprof(1), aa-logprof(1), aa-enforce(1), aa-audit(1), aa-complain(1), aa-disable(1), and <https://wiki.apparmor.net>.


aa-notify

title: aa-notify(8)

text:
# aa-notify(8)

## NAME
aa-notify - display information about logged AppArmor messages.

## SYNOPSIS
aa-notify [option]

## DESCRIPTION
aa-notify will display a summary or provide desktop notifications for AppArmor DENIED messages.

## OPTIONS
aa-notify accepts the following arguments:

-p, --poll

poll AppArmor logs and display desktop notifications. Can be used with '-s' option to display a summary on startup.

--display $DISPLAY

set the DISPLAY environment variable to $DISPLAY (might be needed if sudo resets $DISPLAY)

-f FILE, --file=FILE

search FILE for AppArmor messages

-l, --since-last

show summary since last login.

-s NUM, --since-days=NUM

show summary for last NUM of days.

-u USER, --user=USER

user to drop privileges to when running privileged. When used with the -p option, this should be set to the user that will receive desktop notifications. This has no effect when running under sudo.

-w NUM, --wait=NUM

wait NUM seconds before displaying notifications (for use with -p)

-v, --verbose

show messages with summaries.

-h, --help

displays a short usage statement.

## CONFIGURATION
System-wide configuration for aa-notify is done via /etc/apparmor/notify.conf:

```
  # Set to 'no' to disable AppArmor notifications globally
  show_notifications="yes"
  # Special profiles used to remove privileges for unconfined binaries using user namespaces. If unsure, leave as is.
  userns_special_profiles="unconfined,unprivileged_userns"
  # Theme for aa-notify GUI. See https://ttkthemes.readthedocs.io/en/latest/themes.html for available themes.
  interface_theme="ubuntu"
  # Binaries for which we ignore userns-related capability denials
  ignore_denied_capability="sudo,su"
  # OPTIONAL - kind of operations which display a popup prompt.
  prompt_filter="userns"
  # OPTIONAL - restrict using aa-notify to users in the given group
  # (if not set, everybody who has permissions to read the logfile can use it)
  # use_group="admin"
  # OPTIONAL - custom notification message body
  message_body="This is a custom notification message."
  # OPTIONAL - custom notification message footer
  message_footer="For more information visit https://foo.com"
  # OPTIONAL - custom notification filtering
  # Filters are used to reduce the output of information to only those entries that will match the filter. Filters use Python's regular expression syntax.
  filter.profile="^(foo|bar)$"  # Match the profile:            Only shows notifications for profiles "foo" or "bar"
  filter.operation="^open$"     # Match the operation:          Only shows notifications for "open" operation
  filter.name="^(?!/usr/lib/)"  # Match the name:               Excludes notifications for names starting by "/usr/lib/"
  filter.denied="^r$"           # Match the denied_mask:        Only shows notifications where "r", and only "r", was denied
  filter.family="^inet$"        # Match the network family:     Only shows notifications for "inet" family
  filter.socket="stream"        # Match the network socket type: Only shows notifications for "stream" sockets
```

Per-user configuration is done via $XDG_CONFIG_HOME/apparmor/notify.conf (or the deprecated ~/.apparmor/notify.conf if it exists):

```
  # set to 'yes' to enable AppArmor DENIED notifications
  show_notifications="yes"
```

## BUGS
aa-notify needs to be able to read the logfiles containing the AppArmor DENIED messages.

If you find any additional bugs, please report them to Gitlab at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7)


aa-remove-unknown

title: aa-remove-unknown(8)

summary: remove unknown AppArmor profiles

text:
# aa-remove-unknown(8)

## NAME
aa-remove-unknown - remove unknown AppArmor profiles

## SYNOPSIS
aa-remove-unknown [option]

## DESCRIPTION
aa-remove-unknown will inventory all profiles in /etc/apparmor.d/, compare that list to the profiles currently loaded into the kernel, and then remove all of the loaded profiles that were not found in /etc/apparmor.d/. It will also report the name of each profile that it removes on standard out.

## OPTIONS
-h, --help

displays a short usage statement.

-n

dry run; only prints the names of profiles that would be removed

## EXAMPLES

```
  $ sudo ./aa-remove-unknown -n
  Would remove 'test//null-/usr/bin/whoami'
  Would remove 'test'
  $ sudo ./aa-remove-unknown
  Removing 'test//null-/usr/bin/whoami'
  Removing 'test'
```

## BUGS
None. Please report any you find to Gitlab at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7)


aa-status

title: aa-status(8)

text:
# aa-status(8)

## NAME
aa-status - display various information about the current AppArmor policy.

## SYNOPSIS
aa-status [option]

## DESCRIPTION
aa-status will report various aspects of the current state of AppArmor confinement. By default, it displays the same information as if the --verbose argument were given. A sample of what this looks like is:

```
  apparmor module is loaded.
  110 profiles are loaded.
  102 profiles are in enforce mode.
  8 profiles are in complain mode.
  Out of 129 processes running:
  13 processes have profiles defined.
  8 processes have profiles in enforce mode.
  5 processes have profiles in complain mode.
```

Other argument options are provided to report individual aspects, to support being used in scripts.

## OPTIONS
aa-status accepts only one argument at a time out of:

--enabled

returns error code if AppArmor is not enabled.

--profiled

displays the number of loaded AppArmor policies.

--enforced

displays the number of loaded enforcing AppArmor policies.

--complaining

displays the number of loaded non-enforcing AppArmor policies.

--kill

displays the number of loaded enforcing AppArmor policies that will kill tasks on policy violations.

--prompt

displays the number of loaded enforcing AppArmor policies, with fallback to userspace mediation.

--special-unconfined

displays the number of loaded non-enforcing AppArmor policies that are in the special unconfined mode.

--process-mixed displays the number of processes confined by profile stacks with profiles in different modes.

--verbose

displays multiple data points about loaded AppArmor policy set (the default action if no arguments are given).

--json

displays multiple data points about loaded AppArmor policy set in a JSON format, fit for machine consumption.

--pretty-json

same as --json, formatted to be readable by humans as well as by machines.

--show

what data sets to show information about. Currently processes, profiles, all for both processes and profiles. The default is all.

--count

display only counts for selected information.

--filter.mode=filter

Allows specifying a posix regular expression filter that will be applied against the displayed processes and profiles apparmor profile mode, reducing the output.

--filter.profiles=filter

Allows specifying a posix regular expression filter that will be applied against the displayed processes and profiles confining profile, reducing the output.

--filter.pid=filter

Allows specifying a posix regular expression filter that will be applied against the displayed processes, so that only processes pids matching the expression will be displayed.

--filter.exe=filter

Allows specifying a posix regular expression filter that will be applied against the displayed processes, so that only processes executable name matching the expression will be displayed.

--help

displays a short usage statement.

## EXIT STATUS
Upon exiting, aa-status will set its exit status to the following values:

0

if apparmor is enabled and policy is loaded.

1

if apparmor is not enabled/loaded.

2

if apparmor is enabled but no policy is loaded.

3

if the apparmor control files aren't available under /sys/kernel/security/.

4

if the user running the script doesn't have enough privileges to read the apparmor control files.

42

if an internal error occurred.

## BUGS
aa-status must be run as root to read the state of the loaded policy from the apparmor module. It uses the /proc filesystem to determine which processes are confined and so is susceptible to race conditions.

If you find any additional bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7), apparmor.d(5), and <https://wiki.apparmor.net>.


aa-teardown

title: aa-teardown(8)

summary: unload all AppArmor profiles

text:
# aa-teardown(8)

## NAME
aa-teardown - unload all AppArmor profiles

## SYNOPSIS
aa-teardown

## DESCRIPTION
aa-teardown unloads all AppArmor profiles

## BUGS
If you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7), apparmor.d(5), and <https://wiki.apparmor.net>.


aa-unconfined

title: aa-unconfined(8)

text:
# aa-unconfined(8)

## NAME
aa-unconfined - output a list of processes with tcp or udp ports that do not have AppArmor profiles loaded

## SYNOPSIS
aa-unconfined [options] [--with-ss | --with-netstat]

## OPTIONS
--paranoid

Displays all processes visible from /proc filesystem, and whether they are confined by a profile or "not confined". Equivalent to --show=all.

--show=(all|network|server|client)

Determines the set of processes to be displayed. --show=all show all processes is equivalent to --paranoid

--show=network show only process with any sockets open.

--show=server show only processes with listening sockets open. This is the default value if --show= or --paranoid are not specified.

--show=client show only processes with non-listening sockets open.

--with-ss

Use the ss(8) command to find processes listening on network sockets (the default).

--with-netstat

Use the netstat(8) command to find processes listening on network sockets. This is also what aa-unconfined will fall back to when ss(8) is not available.

## DESCRIPTION
aa-unconfined will use netstat(8) to determine which processes have open network sockets and do not have AppArmor profiles loaded into the kernel.

## BUGS
aa-unconfined must be run as root to retrieve the process executable link from the /proc filesystem. This program is susceptible to race conditions of several flavours: an unlinked executable will be mishandled; an executable started before an AppArmor profile is loaded will not appear in the output, despite running without confinement; a process that dies between the netstat(8) and further checks will be mishandled. This program only lists processes using TCP and UDP. In short, this program is unsuitable for forensics use and is provided only as an aid to profiling all network-accessible processes in the lab.

If you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
ss(8), netstat(8), apparmor(7), apparmor.d(5), aa_change_hat(2), and <https://wiki.apparmor.net>.


title: apparmor_parser(8)

summary: loads AppArmor profiles into the kernel

text:
# apparmor_parser(8)

## NAME
apparmor_parser - loads AppArmor profiles into the kernel

## SYNOPSIS
apparmor_parser [options] <command> [profiles]...

apparmor_parser [options] <command>

apparmor_parser [-hv] [--help] [--version]

## DESCRIPTION
apparmor_parser is used as a general tool to compile, and manage AppArmor policy, including loading new apparmor.d(5) profiles into the Linux kernel.

AppArmor profiles restrict the operations available to processes.

The profiles are loaded into the Linux kernel by the apparmor_parser program. The profiles may be specified by file name or a directory name containing a set of profiles. If a directory is specified then the apparmor_parser will try to do a profile load for each file in the directory that is not a dot file, or explicitly black listed (*.dpkg-new, *.dpkg-old, *.dpkg-dist, *.dpkg-bak, *.dpkg-remove, *.pacsave, *.pacnew, *.rpmnew, *.rpmsave, *.orig, *.rej, *~). The apparmor_parser will fall back to taking input from standard input if a profile or directory is not supplied.

The input supplied to apparmor_parser should be in the format described in apparmor.d(5).

## COMMANDS
The command set is broken into four subcategories.

unprivileged commands

Commands that don't require any privilege and don't operate on profiles.

unprivileged profile commands

Commands that operate on a profile either specified on the command line or read from stdin if no profile was specified.

privileged commands

Commands that require the MAC_ADMIN capability within the affected AppArmor namespace to load policy into the kernel or filesystem write permissions to update the affected privileged files (cache etc).

privileged profile commands

Commands that require privilege and operate on profiles.

## Unprivileged commands
-V, --version

Print the version number and exit.

-h, --help

Give a quick reference guide.

## Unprivileged profile commands
-N, --names

Produce a list of policies from a given set of profiles (implies -K).

-p, --preprocess

Apply preprocessing to the input profile(s) by flattening includes into the output profile and dump to stdout.

-S, --stdout

Writes a binary (cached) profile to stdout (implies -K and -T).

-o file, --ofile file

Writes a binary (cached) profile to the specified file (implies -K and -T)

## Privileged commands
--purge-cache

Unconditionally clear out cached profiles.

## Privileged profile commands
-a, --add

Insert the AppArmor definitions given into the kernel. This is the default action. This gives an error message if a AppArmor definition by the same name already exists in the kernel, or if the parser doesn't understand its input. It reports when an addition succeeded.

-r, --replace

This flag is required if an AppArmor definition by the same name already exists in the kernel; used to replace the definition already in the kernel with the definition given on standard input.

-R, --remove

This flag is used to remove an AppArmor definition already in the kernel. Note that it still requires a complete AppArmor definition as described in apparmor.d(5) even though the contents of the definition aren't used.

## OPTIONS
-B, --binary

Treat the profile files specified on the command line (or stdin if none specified) as binary cache files, produced with the -S or -o options, and load to the kernel as specified by -a, -r, and -R (implies -K and -T).

-C, --Complain

Force the profile to load in complain mode.

-b n, --base n

Set the base directory for resolving #include directives defined as relative paths.

-I n, --Include n

Add element n to the search path when resolving #include directives defined as an absolute paths.

-f n, --apparmorfs n

Set the location of the apparmor security filesystem (default is "/sys/kernel/security/apparmor").

--policy-features n

Specify the feature set that the policy was developed under. This does not override feature ABI rules.

--override-policy-abi n

Specify the feature set that the policy was developed under and override any feature ABI rules that the policy may be using.

--kernel-features n

Specify the feature set of the kernel that the policy is being compiled for. If not specified this will be determined by the system's kernel.

-M n, --features-file n

Use the features file located at path "n" (default is /etc/apparmor.d/cache/.features). If the --cache-loc option is present, the ".features" file in the specified cache directory is used. Note: this sets both the --kernel-features and --policy-features to be the same.

-m n, --match-string n

Only use match features "n". Note: this sets both the --kernel-features and --policy-features to be the same.

-n n, --namespace-string n

Force a profile to load in the namespace "n".

-X, --readimpliesX

In the case of profiles that are loading on systems were READ_IMPLIES_EXEC is set in the kernel for a given process, load the profile so that any "r" flags are processed as "mr".

-k, --show-cache

Report the cache processing (hit/miss details) when loading or saving cached profiles.

-K, --skip-cache

Perform no caching at all: disables -W, implies -T.

-T, --skip-read-cache

By default, if a profile's cache is found in the location specified by --cache-loc and the timestamp is newer than the profile, it will be loaded from the cache. This option disables this cache loading behavior.

-W, --write-cache

Write out cached profiles to the location specified in --cache-loc. Off by default. In cases where abstractions have been changed, and the parser is running with "--replace", it may make sense to also use "--skip-read-cache" with the "--write-cache" option.

--skip-bad-cache

Skip updating the cache if it contains cached profiles in a bad or inconsistent state

-L, --cache-loc

Set the location(s) of the cache directory. This option can accept a comma separated list of directories, which will be searched in order to find a matching cache. The first matching cache file found is used even if a directory later in the search order may contain a newer cache file. If multiple directories are specified and --write-cache has been specified then cache writes will be made to the first directory in the list, all other directories will be treated as read only.

If a cache directory name needs to have a comma as part of the name, it can be specified by using a backslash to escape the comma character in the directory name.

If not specified the cache location defaults to /var/cache/apparmor

--print-cache-dir

Print the cache directory location. This path will be a subdirectory of the directory specified by --cache-loc. The subdirectory used will be influenced by the features available in the currently running kernel or by the features specified with the --match-string or --features-file options.

-Q, --skip-kernel-load

Perform all actions except the actual loading of a profile into the kernel. This is useful for testing profile generation, caching, etc, without making changes to the running kernel profiles. This also removes the need for privilege to execute the commands that manage policy in the kernel

-q, --quiet

Do not report on the profiles as they are loaded, and not show warnings.

-v, --verbose

Report on the profiles as they are loaded, and show warnings.

--warn=n

Enable various warnings during policy compilation. A single warn flag can be specified per --warn option, but the --warn flag can be passed multiple times.

```
  apparmor_parser --warn=rule-not-enforced ...

```

A specific warning can be disabled by prepending no- to the flag

```
  apparmor_parser --warn=no-rule-not-enforced ...

```

Use --help=warn to see a full list of which warn flags are supported.

--Werror[=n]

Convert warnings into errors during policy compilation. If the optional flag is not specified all warnings become errors. If the optional flag is specified only the class of warnings specified will become errors. A single flag can be specified per --Werror option, but the --Werror flag can be passed multiple times.

```
  apparmor_parser --Werror=deprecated ...

```

Use --help=warn or --help=Werror to see a full list of which warn flags are supported.

-d, --debug

Given once, only checks the profiles to ensure syntactic correctness. Given twice, dumps its interpretation of the profile for checking.

-D n, --dump=n

Debug flag for dumping various structures and passes of policy compilation. A single dump flag can be specified per --dump option, but the dump flag can be passed multiple times. Note progress flags tend to also imply the matching stats flag.

```
  apparmor_parser --dump=dfa-stats --dump=trans-stats <file>

```

Use --help=dump to see a full list of which dump flags are supported

-j n, --jobs=n

Set the number of jobs used to compile the specified policy. Where n can be

```
  0    - disable jobs and use the main process for all compilation
  #    - a specific number of jobs
  auto - the # of cpus in the in the system
  x#   - # * number of cpus

```

Eg.

-j8 OR --jobs=8 allows for 8 parallel jobs

-jauto OR --jobs=auto sets the jobs to the # of cpus

-jx4 OR --jobs=x4 sets the jobs to # of cpus * 4

-jx1 is equivalent to -jauto

The default value is the number of cpus in the system. Note that if jobs is a positive integer number the --jobs-max parameter is automatically set to the same value.

--max-jobs n

When --jobs is set to a scaling value (ie. auto or xN) the specify a hard cap on the value that can be specified by the --jobs flag. It takes the same set of options available to the --jobs option, and defaults to 8*cpus

-O n, --optimize=n

Set the optimization flags used by policy compilation. A single optimization flag can be toggled per -O option, but the optimize flag can be passed multiple times. Turning off some phases of the optimization can make it so that policy can't complete compilation due to size constraints (it is entirely possible to create a dfa with millions of states that will take days or longer to compile). Note: The parser is set to use a balanced default set of flags, that will result in reasonable compression but not take excessive amounts of time to complete.

Use --help=optimize to see a full list of which optimization flags are supported.

--abort-on-error Abort processing of profiles on the first error encountered, otherwise the parser will continue to try to compile other profiles if specified.

Note: If an error is encountered while processing profiles the last error encountered will be used to set the exit code.

--skip-bad-cache-rebuild The default behavior of the parser is to check if a cached version of a profile exists and if it does it attempt to load it into the kernel. If that load is rejected, then the parser will attempt to rebuild the cache file, and load again.

This option tells the parser to not attempt to rebuild the cache on failure, instead the parser continues on with processing the remaining profiles.

--estimated-compile-size Adjust the internal parameter used to estimate how aggressive the parser can be when compiling policy. This may include changes to how or when caches are dropped or how many compile units (jobs) are launched. The value should slightly larger than the largest Resident Set Size (RSS) encountered for the type of policy being compiled.

A value that is too small may result in the parser exhausting system resources when compiling large policy. A value too large may slow policy compiles down. The value specified may include a suffix of KB, MB, GB, to make it easier to adjust the size.

Note: config-file and command line options will override values chosen by tuning affected by the option.

--config-file

Specify the config file to use instead of /etc/apparmor/parser.conf. This option will be processed early before regular options regardless of the order it is specified in.

--print-config-file

Print the config file location that will be used.

## CONFIG FILE
An optional config file /etc/apparmor/parser.conf can be used to specify the default options for the parser, which then can be overridden using the command line options.

The config file ignores leading whitespace and treats lines that begin with # as comments. Config options are specified one per line using the same format as the longform command line options (without the preceding --).

Eg.

\#comment

```
    optimize=no-expr-tree
    optimize=compress-fast
```

As with the command line some options accumulate and others override, ie. when there are conflicting versions of switch the last option is the one chosen.

Eg.

Optimize=no-minimize

Optimize=minimize

would result in Optimize=minimize being set.

The Include, Dump, and Optimize options accumulate except for the inversion option (no-X vs. X), and a couple options that work by setting/clearing multiple options (compress-small). In that case the option will override the flags it sets but will may accumulate with others.

All other options override previously set values.

## BUGS
If you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

## SEE ALSO
apparmor(7), apparmor.d(5), aa_change_hat(2), and <https://wiki.apparmor.net>.


apt

package: apt

title: apt(8)

summary: Advanced Package Tool

text:
# apt(8)

## NAME
apt - Advanced Package Tool

## SYNOPSIS
apt

## DESCRIPTION
APT is a management system for software packages. It is still under development; the snazzy front ends are not yet available. In the meantime, please see apt-get(8).

## OPTIONS
None.

## FILES
None.

## SEE ALSO
apt-cache(8), apt-get(8), apt.conf(5), sources.list(5)

## DIAGNOSTICS
apt returns zero on normal operation, decimal 100 on error.

## BUGS
This manpage isn't even started.

See <http://bugs.debian.org/apt>. If you wish to report a bug in apt, please see /usr/share/doc/debian/bug-reporting.txt or the bug(1) command.

## AUTHOR
apt was written by the APT team <apt@packages.debian.org>.


apt-cache

title: apt-cache(8)

text:
# apt-cache(8)

## NAME
apt-cache - APT package handling utility -- cache manipulator

## SYNOPSIS
apt-cache [ -hvsn ] [ -o=config string ] [ -c=file ] [ add file... ] [ gencaches ] [ showpkg pkg... ] [ showsrc pkg... ] [ stats ] [ dump ] [ dumpavail ] [ unmet ] [ search regex ] [ show pkg... ] [ depends pkg... ] [ whatdepends pkg... ] [ pkgnames prefix ] [ dotty pkg... ] [ policy pkgs... ]

## DESCRIPTION
apt-cache performs a variety of operations on APT's package cache. apt-cache does not manipulate the state of the system but does provide operations to search and generate interesting output from the package metadata.

Unless the -h, or --help option is given, one of the commands below must be present.

add file(s)

add adds the named package index files to the package cache. This is for debugging only.

gencaches

gencaches performs the same operation as apt-get check. It builds the source and package caches from the sources in sources.list(5) and from /var/lib/dpkg/status.

showpkg pkg(s)

showpkg displays information about the packages listed on the command line. Remaining arguments are package names. The available versions and reverse dependencies of each package listed are listed, as well as forward dependencies for each version. Forward (normal) dependencies are those packages upon which the package in question depends; reverse dependencies are those packages that depend upon the package in question. Thus, forward dependencies must be satisfied for a package, but reverse dependencies need not be. For instance, apt-cache showpkg libreadline2 would produce output similar to the following:

```
Package: libreadline2
Versions: 2.1-12(/var/lib/apt/lists/foo_Packages),
Reverse Depends:

  libreadlineg2,libreadline2

  libreadline2-altdev,libreadline2
Dependencies:
2.1-12 - libc5 (2 5.4.0-0) ncurses3.0 (0 (null))
Provides:
2.1-12 -
Reverse Provides:

```

Thus it may be seen that libreadline2, version 2.1-12, depends on libc5 and ncurses3.0 which must be installed for libreadline2 to work. In turn, libreadlineg2 and libreadline2-altdev depend on libreadline2. If libreadline2 is installed, libc5 and ncurses3.0 (and ldso) must also be installed; libreadlineg2 and libreadline2-altdev do not have to be installed. For the specific meaning of the remainder of the output it is best to consult the apt source code.

stats

stats displays some statistics about the cache. No further arguments are expected. Statistics reported are:

•

Total package names is the number of package names found in the cache.

•

Normal packages is the number of regular, ordinary package names; these are packages that bear a one-to-one correspondence between their names and the names used by other packages for them in dependencies. The majority of packages fall into this category.

•

Pure virtual packages is the number of packages that exist only as a virtual package name; that is, packages only "provide" the virtual package name, and no package actually uses the name. For instance, "mail-transport-agent" in the Debian GNU/Linux system is a pure virtual package; several packages provide "mail-transport-agent", but there is no package named "mail-transport-agent".

•

Single virtual packages is the number of packages with only one package providing a particular virtual package. For example, in the Debian GNU/Linux system, "X11-text-viewer" is a virtual package, but only one package, xless, provides "X11-text-viewer".

•

Mixed virtual packages is the number of packages that either provide a particular virtual package or have the virtual package name as the package name. For instance, in the Debian GNU/Linux system, "debconf" is both an actual package, and provided by the debconf-tiny package.

•

Missing is the number of package names that were referenced in a dependency but were not provided by any package. Missing packages may be in evidence if a full distribution is not accessed, or if a package (real or virtual) has been dropped from the distribution. Usually they are referenced from Conflicts statements.

•

Total distinct versions is the number of package versions found in the cache; this value is therefore at least equal to the number of total package names. If more than one distribution (both "stable" and "unstable", for instance), is being accessed, this value can be considerably larger than the number of total package names.

•

Total dependencies is the number of dependency relationships claimed by all of the packages in the cache.

showsrc pkg(s)

showsrc displays all the source package records that match the given package names. All versions are shown, as well as all records that declare the name to be a Binary.

dump

dump shows a short listing of every package in the cache. It is primarily for debugging.

dumpavail

dumpavail prints out an available list to stdout. This is suitable for use with and is used by the dselect(8) method.

unmet

unmet displays a summary of all unmet dependencies in the package cache.

show pkg(s)

show performs a function similar to dpkg --print-availi; it displays the package records for the named packages.

search regex [ regex ... ]

search performs a full text search on all available package lists for the regex pattern given. It searches the package names and the descriptions for an occurrence of the regular expression and prints out the package name and the short description. If --full is given then output identical to show is produced for each matched package, and if --names-only is given then the long description is not searched, only the package name is. Separate arguments can be used to specify multiple search patterns that are and'ed together.

depends pkg(s)

depends shows a listing of each dependency a package has and all the possible other packages that can fulfill that dependency.

whatdepends pkg(s)

whatdepends shows a listing of what depends on a package.

pkgnames [ prefix ]

This command prints the name of each package in the system. The optional argument is a prefix match to filter the name list. The output is suitable for use in a shell tab complete function and the output is generated extremely quickly. This command is best used with the --generate option.

dotty pkg(s)

dotty takes a list of packages on the command line and generates output suitable for use by dotty from the GraphViz <URL:http://www.research.att.com/sw/tools/graphviz/> package. The result will be a set of nodes and edges representing the relationships between the packages. By default the given packages will trace out all dependent packages; this can produce a very large graph. To limit the output to only the packages listed on the command line, set the APT::Cache::GivenOnly option. The resulting nodes will have several shapes; normal packages are boxes, pure provides are triangles, mixed provides are diamonds, missing packages are hexagons. Orange boxes mean recursion was stopped [leaf packages], blue lines are pre-depends, green lines are conflicts.

Caution, dotty cannot graph larger sets of packages.

policy [ pkg(s) ]

policy is ment to help debug issues relating to the preferences file. With no arguments it will print out the priorities of each source. Otherwise it prints out detailed information about the priority selection of the named package.

## OPTIONS
All command line options may be set using the configuration file, the descriptions indicate the configuration option to set. For boolean options you can override the config file by using something like -f-,--no-f, -f=no or several other variations.

-p

--pkg-cache

Select the file to store the package cache. The package cache is the primary cache used by all operations. Configuration Item: Dir::Cache::pkgcache.

-s

--src-cache

Select the file to store the source cache. The source is used only by gencaches and it stores a parsed version of the package information from remote sources. When building the package cache the source cache is used to advoid reparsing all of the package files. Configuration Item: Dir::Cache::srcpkgcache.

-q

--quiet

Quiet; produces output suitable for logging, omitting progress indicators. More q's will produce more quietness up to a maximum of 2. You can also use -q=# to set the quietness level, overriding the configuration file. Configuration Item: quiet.

-i

--important

Print only important dependencies; for use with unmet. Causes only Depends and Pre-Depends relations to be printed. Configuration Item: APT::Cache::Important.

-f

--full

Print full package records when searching. Configuration Item: APT::Cache::ShowFull.

-a

--all-versions

Print full records for all available versions. This is the default; to turn it off, use --no-all-versions. If --no-all-versions is specified, only the candidate version will displayed (the one which would be selected for installation). This option is only applicable to the show command. Configuration Item: APT::Cache::AllVersions.

-g

--generate

Perform automatic package cache regeneration, rather than use the cache as it is. This is the default; to turn it off, use --no-generate. Configuration Item: APT::Cache::Generate.

--names-only

-n

Only search on the package names, not the long descriptions. Configuration Item: APT::Cache::NamesOnly.

--all-names

Make pkgnames print all names, including virtual packages and missing dependencies. Configuration Item: APT::Cache::AllNames.

--recurse

Make depends recursive so that all packages mentioned are printed once. Configuration Item: APT::Cache::RecurseDepends.

-h

--help

Show a short usage summary.

-v

--version

Show the program version.

-c

--config-file

Configuration File; Specify a configuration file to use. The program will read the default configuration file and then this configuration file. If configuration settings need to be set before the default configuration files are parsed specify a file with the APT_CONFIG environment variable. See apt.conf(5) for syntax information.

-o

--option

Set a Configuration Option; This will set an arbitrary configuration option. The syntax is -o Foo::Bar=bar.

## FILES
/etc/apt/sources.list

Locations to fetch packages from. Configuration Item: Dir::Etc::SourceList.

/var/lib/apt/lists/

Storage area for state information for each package resource specified in sources.list(5) Configuration Item: Dir::State::Lists.

/var/lib/apt/lists/partial/

Storage area for state information in transit. Configuration Item: Dir::State::Lists (implicit partial).

## SEE ALSO
apt.conf(5), sources.list(5), apt-get(8)

## DIAGNOSTICS
apt-cache returns zero on normal operation, decimal 100 on error.

## BUGS
Reporting bugs in APT-RPM is best done in the APT-RPM mailinglist <URL:http://apt-rpm.org/mailinglist.shtml>.

## AUTHOR
Maintainer and contributor information can be found in the credits page <URL:http://apt-rpm.org/about.shtml> of APT-RPM.


apt-cdrom

title: apt-cdrom(8)

summary: APT CDROM management utility

text:
# apt-cdrom(8)

## NAME
apt-cdrom - APT CDROM management utility

## SYNOPSIS
apt-cdrom [ -hvrmfan ] [ -d=cdrom mount point ] [ -o=config string ] [ -c=file ] [ add ] [ ident ]

## DESCRIPTION
apt-cdrom is used to add a new CDROM to APTs list of available sources. apt-cdrom takes care of determining the structure of the disc as well as correcting for several possible mis-burns and verifying the index files.

It is necessary to use apt-cdrom to add CDs to the APT system, it cannot be done by hand. Furthermore each disk in a multi-cd set must be inserted and scanned separately to account for possible mis-burns.

Unless the -h, or --help option is given one of the commands below must be present.

add

add is used to add a new disc to the source list. It will unmount the CDROM device, prompt for a disk to be inserted and then procceed to scan it and copy the index files. If the disc does not have a proper .disk/ directory you will be prompted for a descriptive title. APT uses a CDROM ID to track which disc is currently in the drive and maintains a database of these IDs in /var/lib/apt/cdroms.list

ident

A debugging tool to report the identity of the current disc as well as the stored file name

## OPTIONS
All command line options may be set using the configuration file, the descriptions indicate the configuration option to set. For boolean options you can override the config file by using something like -f-,--no-f, -f=no or several other variations.

-d

--cdrom

Mount point; specify the location to mount the cdrom. This mount point must be listed in /etc/fstab and properly configured. Configuration Item: Acquire::cdrom::mount.

-r

--rename

Rename a disc; change the label of a disk or override the disks given label. This option will cause apt-cdrom to prompt for a new label. Configuration Item: APT::CDROM::Rename.

-m

--no-mount

No mounting; prevent apt-cdrom from mounting and unmounting the mount point. Configuration Item: APT::CDROM::NoMount.

-f

--fast

Fast Copy; Assume the package files are valid and do not check every package. This option should be used only if apt-cdrom has been run on this disc before and did not detect any errors. Configuration Item: APT::CDROM::Fast.

-a

--thorough

Thorough Package Scan; This option may be needed with some old Debian 1.1/1.2 discs that have Package files in strange places. It takes much longer to scan the CD but will pick them all up.

-n

--just-print

--recon

--no-act

No Changes; Do not change the sources.list(5) file and do not write index files. Everything is still checked however. Configuration Item: APT::CDROM::NoAct.

-h

--help

Show a short usage summary.

-v

--version

Show the program version.

-c

--config-file

Configuration File; Specify a configuration file to use. The program will read the default configuration file and then this configuration file. If configuration settings need to be set before the default configuration files are parsed specify a file with the APT_CONFIG environment variable. See apt.conf(5) for syntax information.

-o

--option

Set a Configuration Option; This will set an arbitrary configuration option. The syntax is -o Foo::Bar=bar.

## SEE ALSO
apt.conf(5), apt-get(8), sources.list(5)

## DIAGNOSTICS
apt-cdrom returns zero on normal operation, decimal 100 on error.

## BUGS
Reporting bugs in APT-RPM is best done in the APT-RPM mailinglist <URL:http://apt-rpm.org/mailinglist.shtml>.

## AUTHOR
Maintainer and contributor information can be found in the credits page <URL:http://apt-rpm.org/about.shtml> of APT-RPM.


apt-config

title: apt-config(8)

summary: APT Configuration Query program

text:
# apt-config(8)

## NAME
apt-config - APT Configuration Query program

## SYNOPSIS
apt-config [ -hv ] [ -o=config string ] [ -c=file ] [ shell ] [ dump ]

## DESCRIPTION
apt-config is an internal program used by various portions of the APT suite to provide consistent configurability. It accesses the main configuration file /etc/apt/apt.conf in a manner that is easy to use by scripted applications.

Unless the -h, or --help option is given one of the commands below must be present.

shell

shell is used to access the configuration information from a shell script. It is given pairs of arguments, the first being a shell variable and the second the configuration value to query. As output it lists a series of shell assignments commands for each present value. In a shell script it should be used like:

```
OPTS="-f"
RES=`apt-config shell OPTS MyApp::Options`
eval $RES

```

This will set the shell environment variable $OPTS to the value of MyApp::Options with a default of -f.

The configuration item may be postfixed with a /[fdbi]. f returns file names, d returns directories, b returns true or false and i returns an integer. Each of the returns is normalized and verified internally.

dump

Just show the contents of the configuration space.

## OPTIONS
All command line options may be set using the configuration file, the descriptions indicate the configuration option to set. For boolean options you can override the config file by using something like -f-,--no-f, -f=no or several other variations.

-h

--help

Show a short usage summary.

-v

--version

Show the program version.

-c

--config-file

Configuration File; Specify a configuration file to use. The program will read the default configuration file and then this configuration file. If configuration settings need to be set before the default configuration files are parsed specify a file with the APT_CONFIG environment variable. See apt.conf(5) for syntax information.

-o

--option

Set a Configuration Option; This will set an arbitrary configuration option. The syntax is -o Foo::Bar=bar.

## SEE ALSO
apt.conf(5)

## DIAGNOSTICS
apt-config returns zero on normal operation, decimal 100 on error.

## BUGS
Reporting bugs in APT-RPM is best done in the APT-RPM mailinglist <URL:http://apt-rpm.org/mailinglist.shtml>.

## AUTHOR
Maintainer and contributor information can be found in the credits page <URL:http://apt-rpm.org/about.shtml> of APT-RPM.