Elaborate on local adjustment of apparmor profiles

os-autoinst · Oct 7, 2021 · 3a21df5 · 3a21df5
1 parent b46be48
commit 3a21df5
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/docs/Installing.asciidoc b/docs/Installing.asciidoc
@@ -897,9 +897,13 @@ When using `apparmor` the called hook scripts must be covered by according
   /usr/share/openqa/script/client rix,
 ```
 
-Any stderr output of the hook scripts should be visible in the system logs of
-the openQA GRU service, the general status and any stdout output is visible in
-the GRU minion job dashboard on the route
+Additions should be added to `/etc/apparmor.d/local/usr.share.openqa.script.openqa`
+after which the **apparmor** service needs to be restarted for changes to take effect.
+Note that symlinks are only supported along with the real destination.
+
+Apparmor denials and stderr output of the hook scripts are visible in the system logs
+of the openQA GRU service, except for messages in "complain" mode which end up in `audit.log`.
+General status and stdout output is visible in the GRU minion job dashboard on the route
 `/minion/jobs?offset=0&task=finalize_job_results` of the openQA instance.
 
 === Automatic cloning of incomplete jobs