.\" -*- mode: troff; coding: utf-8 -*- .\" Automatically generated by Pod::Man v6.0.2 (Pod::Simple 3.48) .\" .\" Standard preamble: .\" ======================================================================== .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>. .ie n \{\ . ds C` "" . ds C' "" 'br\} .el\{\ . ds C` . ds C' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" .\" If the F register is >0, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .\" .\" Avoid warning from groff about undefined register 'F'. .de IX .. .nr rF 0 .if \n(.g .if rF .nr rF 1 .if (\n(rF:(\n(.g==0)) \{\ . if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . if !\nF==2 \{\ . nr % 0 . nr F 2 . \} . \} .\} .rr rF .\" .\" Required to disable full justification in groff 1.23.0. .if n .ds AD l .\" ======================================================================== .\" .IX Title "AA-NOTIFY 8" .TH AA-NOTIFY 8 2026-09-13 "AppArmor 5.0.2" AppArmor .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l .nh .SH NAME aa\-notify \- display information about logged AppArmor messages. .SH SYNOPSIS .IX Header "SYNOPSIS" \&\fBaa\-notify\fR [option] .SH DESCRIPTION .IX Header "DESCRIPTION" \&\fBaa\-notify\fR will display a summary or provide desktop notifications for AppArmor DENIED messages. .SH OPTIONS .IX Header "OPTIONS" \&\fBaa\-notify\fR accepts the following arguments: .IP "\-p, \-\-poll" 4 .IX Item "-p, --poll" poll AppArmor logs and display desktop notifications. Can be used with \*(Aq\-s\*(Aq option to display a summary on startup. .ie n .IP "\-\-display $DISPLAY" 4 .el .IP "\-\-display \f(CW$DISPLAY\fR" 4 .IX Item "--display $DISPLAY" set the DISPLAY environment variable to \f(CW$DISPLAY\fR (might be needed if sudo resets \f(CW$DISPLAY\fR) .IP "\-\-xauthority XAUTHORITY" 4 .IX Item "--xauthority XAUTHORITY" set the XAUTHORITY environment variable (might be needed if sudo resets XAUTHORITY) .IP "\-f FILE, \-\-file=FILE" 4 .IX Item "-f FILE, --file=FILE" search FILE for AppArmor messages .IP "\-l, \-\-since\-last" 4 .IX Item "-l, --since-last" show summary since last login. .IP "\-s NUM, \-\-since\-days=NUM" 4 .IX Item "-s NUM, --since-days=NUM" show summary for last NUM of days. .IP "\-u USER, \-\-user=USER" 4 .IX Item "-u USER, --user=USER" user to drop privileges to when running privileged. When used with the \-p option, this should be set to the user that will receive desktop notifications. This has no effect when running under sudo. .IP "\-w NUM, \-\-wait=NUM" 4 .IX Item "-w NUM, --wait=NUM" wait NUM seconds before displaying notifications (for use with \-p) .IP "\-m, \-\-merge\-notifications" 4 .IX Item "-m, --merge-notifications" Merge notification for improved readability (with \-p) .IP "\-F, \-\-foreground" 4 .IX Item "-F, --foreground" Do not fork to the background .IP "\-\-prompt\-filter operation" 4 .IX Item "--prompt-filter operation" Which operations should use a popup prompt window instead of a system notification. .Sp eg. \-\-prompt\-filter="userns" .IP "\-\-filter.TYPE FILTER" 4 .IX Item "--filter.TYPE FILTER" Apply filters as to select which apparmor messages should be allowed through based on which messages match the filter parameters (see also custom notification filtering in CONFIGURATION). Filters use Python\*(Aqs regular expression syntax. .Sp Supported Filter TYPE: .RS 4 .IP "profile \- name of the profile =item mode \- mode eg, DENIED, ALLOWED, STATUS \-item operation \- operation being mediated eg. open \-item name \- name of object, eg. file name /home/foo/bar \-item denied \- permissions that were denied \-item family \- socket family, eg. inet, inet6, netlink \-item socket \- socket type. eg. stream, dgram, rdm" 4 .IX Item "profile - name of the profile =item mode - mode eg, DENIED, ALLOWED, STATUS -item operation - operation being mediated eg. open -item name - name of object, eg. file name /home/foo/bar -item denied - permissions that were denied -item family - socket family, eg. inet, inet6, netlink -item socket - socket type. eg. stream, dgram, rdm" .RE .RS 4 .RE .IP "\-L, \-\-local [{yes,no,auto}]" 4 .IX Item "-L, --local [{yes,no,auto}]" add rules to a local profiles instead of the real profiles. This simplify profiles\*(Aq deployment by keeping local modifications self\-contained. \- \fByes\fR: always use a local profile \- \fBno\fR: never use a local profile \- \fBauto\fR: use a local profile if the main profile already relies on a local profile .IP "\-v, \-\-verbose" 4 .IX Item "-v, --verbose" show messages with summaries. .IP debug 4 .IX Item "debug" provide debug output .IP "\-h, \-\-help" 4 .IX Item "-h, --help" displays a short usage statement. .SH CONFIGURATION .IX Header "CONFIGURATION" System\-wide configuration for \fBaa\-notify\fR is done via /etc/apparmor/notify.conf: .PP .Vb 2 \& # Set to \*(Aqno\*(Aq to disable AppArmor notifications globally \& show_notifications="yes" \& \& # Special profiles used to remove privileges for unconfined binaries using user namespaces. Special profiles use Python\*(Aqs regular expression syntax. If unsure, leave as is. \& userns_special_profiles="unconfined,unprivileged_userns,unpriv_.*" \& \& # Theme for aa\-notify GUI. See https://ttkthemes.readthedocs.io/en/latest/themes.html for available themes. \& interface_theme="ubuntu" \& \& # Binaries for which we ignore userns\-related capability denials \& ignore_denied_capability="sudo,su" \& \& # Write change to local profiles if enabled to preserve regular profiles and simplify upgrades (yes, no, auto) \& use_local_profiles="yes" \& \& # OPTIONAL \- kind of operations which display a popup prompt. \& prompt_filter="userns" \& \& # OPTIONAL \- restrict using aa\-notify to users in the given group \& # (if not set, everybody who has permissions to read the logfile can use it) \& # use_group="admin" \& \& # OPTIONAL \- custom notification message body \& message_body="This is a custom notification message." \& \& # OPTIONAL \- custom notification message footer \& message_footer="For more information visit https://foo.com" \& \& # OPTIONAL \- custom notification filtering \& # Filters are used to reduce the output of information to only those entries that will match the filter. Filters use Python\*(Aqs regular expression syntax. \& filter.profile="^(foo|bar)$" # Match the profile: Only shows notifications for profiles "foo" or "bar" \& filter.mode="^STATUS$" # Match the mode: Only show notifications for "STATUS" messages, where mode can be: \& UNKNOWN an unknown AppArmor mode \& ERROR an error other than a regular denial occurred \& ALLOWED a permissions request which did not match a rule, was allowed due to complain mode. \& DENIED a permissions request was denied \& HINT additional context information \& STATUS some policy or enforcement change has occurred \& KILLED a permission request was denied and the process that attempted the access was killed. \& filter.operation="^open$" # Match the operation: Only shows notifications for "open" operation \& filter.name="^(?!/usr/lib/)" # Match the name: Excludes notifications for names starting by "/usr/lib/" \& filter.denied="^r$" # Match the denied_mask: Only shows notifications where "r", and only "r", was denied \& filter.family="^inet$" # Match the network family: Only shows notifications for "inet" family \& filter.socket="stream" # Match the network socket type: Only shows notifications for "stream" sockets .Ve .PP Per\-user configuration is done via \f(CW$XDG_CONFIG_HOME\fR/apparmor/notify.conf (or the deprecated ~/.apparmor/notify.conf if it exists): .PP .Vb 2 \& # set to \*(Aqyes\*(Aq to enable AppArmor DENIED notifications \& show_notifications="yes" .Ve .SH BUGS .IX Header "BUGS" \&\fBaa\-notify\fR needs to be able to read the logfiles containing the AppArmor DENIED messages. .PP If you find any additional bugs, please report them to Gitlab at . .SH "SEE ALSO" .IX Header "SEE ALSO" \&\fBapparmor\fR\|(7)