What does 'aa-complain' accomplish in AppArmor?

The command 'aa-complain' is specifically used in the context of AppArmor, which is a Linux security module that allows for easy application confinement through the use of profiles. When you use 'aa-complain', it puts a given AppArmor profile into "complain mode."

In complain mode, the profile does not enforce restrictions; rather, it allows the application to run normally while monitoring its actions. Any access violations or security events that would normally be denied are instead logged as warnings. This mode is incredibly useful for debugging or developing profiles, as it lets administrators see what actions an application would have been blocked from performing, without actually enforcing those restrictions.

Running a profile in this mode helps in refining the profile by gathering data on its interactions, allowing system administrators to make adjustments before moving it to enforce mode, where it will actively restrict behavior according to the profile's rules.