AppArmor : Enable / Disable AppArmor2024/06/18

This is the Basic Usage and Configuration for AppArmor (Application Armor).

It's possible to use MAC (Mandatory Access Control) feature on Ubuntu for various resources by AppArmor.

[1]

Display the current status of AppArmor to use AppArmor.
(Follow is the status of default settings after installing Ubuntu)

# show status
# 24 profiles are loaded in [enforce] mode

root@dlp:~#

aa-status

112 profiles are loaded.
24 profiles are in enforce mode.
   /usr/bin/man
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   lsb_release
   man_filter
   man_groff
   nvidia_modprobe
   nvidia_modprobe//kmod
   plasmashell
   plasmashell//QtWebEngineProcess
   rsyslogd
   tcpdump
   ubuntu_pro_apt_news
   ubuntu_pro_esm_cache
   ubuntu_pro_esm_cache//apt_methods
   ubuntu_pro_esm_cache//apt_methods_gpgv
   ubuntu_pro_esm_cache//cloud_id
   ubuntu_pro_esm_cache//dpkg
   ubuntu_pro_esm_cache//ps
   ubuntu_pro_esm_cache//ubuntu_distro_info
   ubuntu_pro_esm_cache_systemctl
   ubuntu_pro_esm_cache_systemd_detect_virt
   unix-chkpwd
   unprivileged_userns
0 profiles are in complain mode.
0 profiles are in prompt mode.
0 profiles are in kill mode.
88 profiles are in unconfined mode.
   1password
   Discord
   MongoDB Compass
   QtWebEngineProcess
   brave
   buildah
   busybox

.....
.....

   vpnns
   vscode
   wpcom
1 processes have profiles defined.
1 processes are in enforce mode.
   /usr/sbin/rsyslogd (688) rsyslogd
0 processes are in complain mode.
0 processes are in prompt mode.
0 processes are in kill mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.

# configuration files of each profile are under the directory below

root@dlp:~#

ll /etc/apparmor.d

total 464
drwxr-xr-x   9 root root  4096 Jun  4 23:44 ./
drwxr-xr-x 108 root root  4096 Jun 17 04:08 ../
-rw-r--r--   1 root root   354 Mar 31 07:27 1password
-rw-r--r--   1 root root   352 Mar 31 07:27 Discord
-rw-r--r--   1 root root   386 Mar 31 07:27 MongoDB_Compass
-rw-r--r--   1 root root   404 Mar 31 07:27 QtWebEngineProcess
drwxr-xr-x   2 root root  4096 Apr 23 09:40 abi/
drwxr-xr-x   4 root root  4096 Apr 23 09:40 abstractions/
-rw-r--r--   1 root root   348 Mar 31 07:27 brave
-rw-r--r--   1 root root   342 Mar 31 07:27 buildah
-rw-r--r--   1 root root   342 Mar 31 07:27 busybox
-rw-r--r--   1 root root   330 Mar 31 07:27 cam
-rw-r--r--   1 root root   351 Mar 31 07:27 ch-checkns
-rw-r--r--   1 root root   339 Mar 31 07:27 ch-run
-rw-r--r--   1 root root   349 Mar 31 07:27 chrome
-rw-r--r--   1 root root   349 Mar 31 07:27 code
-rw-r--r--   1 root root   333 Mar 31 07:27 crun
.....
.....

[2]	If you'd like to disable AppArmor itself, configure like follows.

# disable loading profiles when system booting

root@dlp:~#

systemctl disable apparmor

Synchronizing state of apparmor.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install disable apparmor
Removed "/etc/systemd/system/sysinit.target.wants/apparmor.service".

root@dlp:~#

reboot

# this will disable all profiles other than the one the kernel loads

root@dlp:~#

aa-enabled

Yes
root@dlp:~#

aa-status

apparmor module is loaded.
3 profiles are loaded.
3 profiles are in enforce mode.
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   rsyslogd
0 profiles are in complain mode.
0 profiles are in prompt mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
1 processes have profiles defined.
1 processes are in enforce mode.
   /usr/sbin/rsyslogd (595) rsyslogd
0 processes are in complain mode.
0 processes are in prompt mode.
0 processes are in kill mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.

# if you want to completely disable it, including the kernel side,
# add the kernel parameter like follows

root@dlp:~#

vi /etc/default/grub

# line 11 : add

GRUB_CMDLINE_LINUX="

apparmor=0

root@dlp:~#

update-grub

root@dlp:~#

reboot

root@dlp:~#

aa-enabled

No - disabled at boot.
root@dlp:~#

aa-status

apparmor module is loaded.
apparmor filesystem is not mounted.

Matched Content