AppArmor : Enable / Disable Profiles2023/07/13 |
|
It's possible to enable or disable each profile if you don't need.
|
|
| [1] | Install a package which includes tools for AppArmor settings. |
|
root@dlp:~# apt -y install apparmor-utils
|
| [2] | Disable a profile which is currently loaded. |
|
root@dlp:~# aa-status
apparmor module is loaded.
10 profiles are loaded.
10 profiles are in enforce mode.
/usr/bin/man
/usr/lib/NetworkManager/nm-dhcp-client.action
/usr/lib/NetworkManager/nm-dhcp-helper
/usr/lib/connman/scripts/dhclient-script
/{,usr/}sbin/dhclient
lsb_release
man_filter
man_groff
nvidia_modprobe
nvidia_modprobe//kmod
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.
# configuration files for each profile are under the directory below root@dlp:~# ll /etc/apparmor.d total 40 drwxr-xr-x 2 root root 4096 Jun 11 19:27 abi drwxr-xr-x 4 root root 4096 Jun 11 19:27 abstractions drwxr-xr-x 2 root root 4096 Feb 14 05:49 disable drwxr-xr-x 2 root root 4096 Feb 14 05:49 force-complain drwxr-xr-x 2 root root 4096 Jun 11 19:30 local -rw-r--r-- 1 root root 1379 Feb 14 05:49 lsb_release -rw-r--r-- 1 root root 1189 Feb 14 05:49 nvidia_modprobe -rw-r--r-- 1 root root 3461 Mar 30 04:02 sbin.dhclient drwxr-xr-x 5 root root 4096 Jun 11 19:27 tunables -rw-r--r-- 1 root root 3448 Mar 12 17:23 usr.bin.man # for example, disable [/usr/bin/man] root@dlp:~# aa-disable /usr/bin/man Disabling /usr/bin/man. aa-status
apparmor module is loaded.
7 profiles are loaded.
7 profiles are in enforce mode.
/usr/lib/NetworkManager/nm-dhcp-client.action
/usr/lib/NetworkManager/nm-dhcp-helper
/usr/lib/connman/scripts/dhclient-script
/{,usr/}sbin/dhclient
lsb_release
nvidia_modprobe
nvidia_modprobe//kmod
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.
# disabled profile is moved to the directory below root@dlp:~# ll /etc/apparmor.d/disable total 0 lrwxrwxrwx 1 root root 27 Jul 12 19:34 usr.bin.man -> /etc/apparmor.d/usr.bin.man |
| [3] | Enable a profile which is currently disabled. |
|
root@dlp:~# aa-status
apparmor module is loaded.
7 profiles are loaded.
7 profiles are in enforce mode.
/usr/lib/NetworkManager/nm-dhcp-client.action
/usr/lib/NetworkManager/nm-dhcp-helper
/usr/lib/connman/scripts/dhclient-script
/{,usr/}sbin/dhclient
lsb_release
nvidia_modprobe
nvidia_modprobe//kmod
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.
# for example, enable [/usr/bin/man] with [enforce] mode # [enforce] mode : allow only actions that are defined in a profile # [complain] mode : denied actions are logged but they are not actually denied root@dlp:~# aa-enforce /usr/bin/man Setting /usr/bin/man to enforce mode. aa-status
apparmor module is loaded.
10 profiles are loaded.
10 profiles are in enforce mode.
/usr/bin/man
/usr/lib/NetworkManager/nm-dhcp-client.action
/usr/lib/NetworkManager/nm-dhcp-helper
/usr/lib/connman/scripts/dhclient-script
/{,usr/}sbin/dhclient
lsb_release
man_filter
man_groff
nvidia_modprobe
nvidia_modprobe//kmod
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.
|
| Sponsored Link |