AppArmor : Enable / Disable Profiles2024/06/18

	It's possible to enable or disable each profile if you don't need.
[1]	Install a package which includes tools for AppArmor settings.

root@dlp:~#

apt -y install apparmor-utils

[2]	Disable a profile which is currently loaded.

root@dlp:~#

aa-status

apparmor module is loaded.
112 profiles are loaded.
24 profiles are in enforce mode.
   /usr/bin/man
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   lsb_release
   man_filter
   man_groff
   nvidia_modprobe
   nvidia_modprobe//kmod
   plasmashell
   plasmashell//QtWebEngineProcess
   rsyslogd
   tcpdump
   ubuntu_pro_apt_news
   ubuntu_pro_esm_cache
   ubuntu_pro_esm_cache//apt_methods
   ubuntu_pro_esm_cache//apt_methods_gpgv
   ubuntu_pro_esm_cache//cloud_id
   ubuntu_pro_esm_cache//dpkg
   ubuntu_pro_esm_cache//ps
   ubuntu_pro_esm_cache//ubuntu_distro_info
   ubuntu_pro_esm_cache_systemctl
   ubuntu_pro_esm_cache_systemd_detect_virt
   unix-chkpwd
   unprivileged_userns
0 profiles are in complain mode.
0 profiles are in prompt mode.
0 profiles are in kill mode.
88 profiles are in unconfined mode.
.....
.....

# configuration files for each profile are under the directory below

root@dlp:~#

ll /etc/apparmor.d

total 464
drwxr-xr-x   9 root root  4096 Jun  4 23:44 ./
drwxr-xr-x 108 root root  4096 Jun 17 04:08 ../
-rw-r--r--   1 root root   354 Mar 31 07:27 1password
-rw-r--r--   1 root root   352 Mar 31 07:27 Discord
-rw-r--r--   1 root root   386 Mar 31 07:27 MongoDB_Compass
-rw-r--r--   1 root root   404 Mar 31 07:27 QtWebEngineProcess
drwxr-xr-x   2 root root  4096 Apr 23 09:40 abi/
drwxr-xr-x   4 root root  4096 Apr 23 09:40 abstractions/
.....
.....

# to disable a profile, specify the profile name
# disable [tcpdump] as an example

root@dlp:~#

aa-disable usr.bin.tcpdump

Disabling /etc/apparmor.d/usr.bin.tcpdump.

# disable [rsyslogd] as an example

root@dlp:~#

aa-disable usr.sbin.rsyslogd

Disabling /etc/apparmor.d/usr.sbin.rsyslogd.

# possible to check the disabled profiles here

root@dlp:~#

ll /etc/apparmor.d/disable

total 8
drwxr-xr-x 2 root root 4096 Jun 18 00:16 ./
drwxr-xr-x 9 root root 4096 Jun  4 23:44 ../
lrwxrwxrwx 1 root root   31 Jun 18 00:16 usr.bin.tcpdump -> /etc/apparmor.d/usr.bin.tcpdump
lrwxrwxrwx 1 root root   33 Jun 18 00:16 usr.sbin.rsyslogd -> /etc/apparmor.d/usr.sbin.rsyslogd

root@dlp:~#

aa-status

apparmor module is loaded.
110 profiles are loaded.
22 profiles are in enforce mode.
   /usr/bin/man
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   lsb_release
   man_filter
   man_groff
   nvidia_modprobe
   nvidia_modprobe//kmod
   plasmashell
   plasmashell//QtWebEngineProcess
   ubuntu_pro_apt_news
   ubuntu_pro_esm_cache
   ubuntu_pro_esm_cache//apt_methods
   ubuntu_pro_esm_cache//apt_methods_gpgv
   ubuntu_pro_esm_cache//cloud_id
   ubuntu_pro_esm_cache//dpkg
   ubuntu_pro_esm_cache//ps
   ubuntu_pro_esm_cache//ubuntu_distro_info
   ubuntu_pro_esm_cache_systemctl
   ubuntu_pro_esm_cache_systemd_detect_virt
   unix-chkpwd
   unprivileged_userns
0 profiles are in complain mode.
0 profiles are in prompt mode.
0 profiles are in kill mode.
88 profiles are in unconfined mode.
.....
.....

[3]	Enable a profile which is currently disabled.

# for example, enable [tcpdump] in [enforce] mode
# [enforce] mode : allow only actions that are defined in a profile
# [complain] mode : denied actions are logged but they are not actually denied

root@dlp:~#

aa-enforce usr.bin.tcpdump

Setting /etc/apparmor.d/usr.bin.tcpdump to enforce mode.

# for example, enable [rsyslogd] in [complain] mode

root@dlp:~#

aa-complain usr.sbin.rsyslogd

Setting /etc/apparmor.d/usr.sbin.rsyslogd to complain mode.

root@dlp:~#

aa-status

apparmor module is loaded.
112 profiles are loaded.
23 profiles are in enforce mode.
   /usr/bin/man
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   lsb_release
   man_filter
   man_groff
   nvidia_modprobe
   nvidia_modprobe//kmod
   plasmashell
   plasmashell//QtWebEngineProcess
   tcpdump
   ubuntu_pro_apt_news
   ubuntu_pro_esm_cache
   ubuntu_pro_esm_cache//apt_methods
   ubuntu_pro_esm_cache//apt_methods_gpgv
   ubuntu_pro_esm_cache//cloud_id
   ubuntu_pro_esm_cache//dpkg
   ubuntu_pro_esm_cache//ps
   ubuntu_pro_esm_cache//ubuntu_distro_info
   ubuntu_pro_esm_cache_systemctl
   ubuntu_pro_esm_cache_systemd_detect_virt
   unix-chkpwd
   unprivileged_userns
1 profiles are in complain mode.
   rsyslogd
0 profiles are in prompt mode.
0 profiles are in kill mode.
88 profiles are in unconfined mode.
.....
.....

Matched Content