AppArmor : Enable / Disable AppArmor2022/12/16 |
|
This is the Basic Usage and Configuration for AppArmor (Application Armor).
It's possible to use MAC (Mandatory Access Control) feature on Ubuntu for various resources by AppArmor.
|
|
| [1] | Display the current status of AppArmor to use AppArmor. (Follow is the status of default settings after installing Ubuntu) |
|
# show status # 13 profiles are loaded in [enforce] mode root@dlp:~# aa-status
apparmor module is loaded.
13 profiles are loaded.
13 profiles are in enforce mode.
/usr/bin/man
/usr/lib/NetworkManager/nm-dhcp-client.action
/usr/lib/NetworkManager/nm-dhcp-helper
/usr/lib/connman/scripts/dhclient-script
/usr/lib/snapd/snap-confine
/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
/{,usr/}sbin/dhclient
lsb_release
man_filter
man_groff
nvidia_modprobe
nvidia_modprobe//kmod
tcpdump
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.
# configuration files of each profile are under the directory below root@dlp:~# ll /etc/apparmor.d total 92 drwxr-xr-x 8 root root 4096 Dec 8 10:33 ./ drwxr-xr-x 97 root root 4096 Dec 15 11:14 ../ drwxr-xr-x 2 root root 4096 Sep 19 12:51 abi/ drwxr-xr-x 4 root root 12288 Sep 19 12:51 abstractions/ drwxr-xr-x 2 root root 4096 Apr 21 2022 disable/ drwxr-xr-x 2 root root 4096 Mar 10 2022 force-complain/ drwxr-xr-x 2 root root 4096 Sep 19 12:51 local/ -rw-r--r-- 1 root root 1339 Mar 10 2022 lsb_release -rw-r--r-- 1 root root 1189 Mar 10 2022 nvidia_modprobe -rw-r--r-- 1 root root 3461 Jul 19 16:54 sbin.dhclient drwxr-xr-x 5 root root 4096 Sep 19 12:51 tunables/ -rw-r--r-- 1 root root 3448 Mar 18 2022 usr.bin.man -rw-r--r-- 1 root root 1421 Jun 21 2021 usr.bin.tcpdump -rw-r--r-- 1 root root 28486 Nov 28 13:53 usr.lib.snapd.snap-confine.real -rw-r--r-- 1 root root 1592 Nov 16 2021 usr.sbin.rsyslogd |
| [2] | If you'd like to disable AppArmor itself, configure like follows. |
|
# unload current all loaded profiles root@dlp:~# aa-teardown Unloading AppArmor profiles
root@dlp:~#
aa-status apparmor module is loaded. # disable loading profiles when system booting root@dlp:~# systemctl disable apparmor Synchronizing state of apparmor.service with SysV service script with /lib/systemd/systemd-sysv-install. Executing: /lib/systemd/systemd-sysv-install disable apparmor Removed /etc/systemd/system/sysinit.target.wants/apparmor.service. |
| Sponsored Link |