aa-complain

Set a profile to complain mode

$ sudo aa-complain [path/to/profile]

$ sudo aa-complain [path/to/profile1] [path/to/profile2]

$ sudo aa-complain -d [path/to/profiles]

$ sudo aa-complain --no-reload [path/to/profile]

aa-complain executable [executable ...] [-d /path/to/profiles] [--no-reload]

aa-complain switches AppArmor security profiles into complain mode. In this mode, security policy is not enforced but access violations are logged to the system log. This is useful for testing and developing new profiles without blocking application functionality.

-d, --dir /path/to/profiles

Specifies the directory containing AppArmor profiles; defaults to /etc/apparmor.d

Prevents automatic profile reloading after modifications

Deny rules remain active even when complain mode is enabled. Complain mode only affects allow rules, so explicit denials will still block access.

Part of the AppArmor utilities package for managing application security profiles on Linux systems.

aa-enforce(8), aa-disable(8), aa-status(8), aa-audit(8), apparmor(7)