AppArmor : Enable / Disable AppArmor2024/06/18 |
|
This is the Basic Usage and Configuration for AppArmor (Application Armor). It's possible to use MAC (Mandatory Access Control) feature on Ubuntu for various resources by AppArmor. |
|
| [1] | Display the current status of AppArmor to use AppArmor. (Follow is the status of default settings after installing Ubuntu) |
|
# show status # 24 profiles are loaded in [enforce] mode root@dlp:~# aa-status 112 profiles are loaded. 24 profiles are in enforce mode. /usr/bin/man /usr/lib/snapd/snap-confine /usr/lib/snapd/snap-confine//mount-namespace-capture-helper lsb_release man_filter man_groff nvidia_modprobe nvidia_modprobe//kmod plasmashell plasmashell//QtWebEngineProcess rsyslogd tcpdump ubuntu_pro_apt_news ubuntu_pro_esm_cache ubuntu_pro_esm_cache//apt_methods ubuntu_pro_esm_cache//apt_methods_gpgv ubuntu_pro_esm_cache//cloud_id ubuntu_pro_esm_cache//dpkg ubuntu_pro_esm_cache//ps ubuntu_pro_esm_cache//ubuntu_distro_info ubuntu_pro_esm_cache_systemctl ubuntu_pro_esm_cache_systemd_detect_virt unix-chkpwd unprivileged_userns 0 profiles are in complain mode. 0 profiles are in prompt mode. 0 profiles are in kill mode. 88 profiles are in unconfined mode. 1password Discord MongoDB Compass QtWebEngineProcess brave buildah busybox ..... ..... vpnns vscode wpcom 1 processes have profiles defined. 1 processes are in enforce mode. /usr/sbin/rsyslogd (688) rsyslogd 0 processes are in complain mode. 0 processes are in prompt mode. 0 processes are in kill mode. 0 processes are unconfined but have a profile defined. 0 processes are in mixed mode. # configuration files of each profile are under the directory below root@dlp:~# ll /etc/apparmor.d total 464 drwxr-xr-x 9 root root 4096 Jun 4 23:44 ./ drwxr-xr-x 108 root root 4096 Jun 17 04:08 ../ -rw-r--r-- 1 root root 354 Mar 31 07:27 1password -rw-r--r-- 1 root root 352 Mar 31 07:27 Discord -rw-r--r-- 1 root root 386 Mar 31 07:27 MongoDB_Compass -rw-r--r-- 1 root root 404 Mar 31 07:27 QtWebEngineProcess drwxr-xr-x 2 root root 4096 Apr 23 09:40 abi/ drwxr-xr-x 4 root root 4096 Apr 23 09:40 abstractions/ -rw-r--r-- 1 root root 348 Mar 31 07:27 brave -rw-r--r-- 1 root root 342 Mar 31 07:27 buildah -rw-r--r-- 1 root root 342 Mar 31 07:27 busybox -rw-r--r-- 1 root root 330 Mar 31 07:27 cam -rw-r--r-- 1 root root 351 Mar 31 07:27 ch-checkns -rw-r--r-- 1 root root 339 Mar 31 07:27 ch-run -rw-r--r-- 1 root root 349 Mar 31 07:27 chrome -rw-r--r-- 1 root root 349 Mar 31 07:27 code -rw-r--r-- 1 root root 333 Mar 31 07:27 crun ..... ..... |
| [2] | If you'd like to disable AppArmor itself, configure like follows. |
|
# disable loading profiles when system booting root@dlp:~# systemctl disable apparmor Synchronizing state of apparmor.service with SysV service script with /usr/lib/systemd/systemd-sysv-install. Executing: /usr/lib/systemd/systemd-sysv-install disable apparmor Removed "/etc/systemd/system/sysinit.target.wants/apparmor.service".
root@dlp:~#
# this will disable all profiles other than the one the kernel loads root@dlp:~# aa-enabled Yes root@dlp:~# aa-status apparmor module is loaded. 3 profiles are loaded. 3 profiles are in enforce mode. /usr/lib/snapd/snap-confine /usr/lib/snapd/snap-confine//mount-namespace-capture-helper rsyslogd 0 profiles are in complain mode. 0 profiles are in prompt mode. 0 profiles are in kill mode. 0 profiles are in unconfined mode. 1 processes have profiles defined. 1 processes are in enforce mode. /usr/sbin/rsyslogd (595) rsyslogd 0 processes are in complain mode. 0 processes are in prompt mode. 0 processes are in kill mode. 0 processes are unconfined but have a profile defined. 0 processes are in mixed mode. # if you want to completely disable it, including the kernel side, # add the kernel parameter like follows
root@dlp:~#
vi /etc/default/grub # line 11 : add GRUB_CMDLINE_LINUX=" apparmor=0 "
aa-enabled No - disabled at boot. root@dlp:~# aa-status apparmor module is loaded. apparmor filesystem is not mounted. |
| Sponsored Link |