AppArmor: Complain Mode and Disabling a Profile

Two AppArmor profiles ship in enforce mode under /etc/apparmor.d/. One is too strict and needs tuning, so move it to complain mode (log denials, don't block); another must be disabled entirely. Your assignment is in /root/case/assignment.env (COMPLAIN_PROFILE, DISABLE_PROFILE).

1. Complain mode — either add flags=(complain) to the profile's header line, or create the force-complain symlink (ln -s ../COMPLAIN_PROFILE /etc/apparmor.d/force-complain/COMPLAIN_PROFILE), which is what aa-complain does.

2. Disable — link the profile into the disable directory: ln -s ../DISABLE_PROFILE /etc/apparmor.d/disable/DISABLE_PROFILE (what aa-disable does).

Grading reads the profile files and symlinks (it does not load AppArmor). On a live host: apparmor_parser -R, systemctl reload apparmor, then aa-status. See /root/case/brief.txt.