AppArmor : Enable / Disable AppArmor2023/07/13 |
This is the Basic Usage and Configuration for AppArmor (Application Armor).
It's possible to use MAC (Mandatory Access Control) feature on Ubuntu for various resources by AppArmor.
|
|
[1] | Display the current status of AppArmor to use AppArmor. (Follow is the status of default settings after installing Ubuntu) |
# show status # 13 profiles are loaded in [enforce] mode root@dlp:~# aa-status apparmor module is loaded. 10 profiles are loaded. 10 profiles are in enforce mode. /usr/bin/man /usr/lib/NetworkManager/nm-dhcp-client.action /usr/lib/NetworkManager/nm-dhcp-helper /usr/lib/connman/scripts/dhclient-script /{,usr/}sbin/dhclient lsb_release man_filter man_groff nvidia_modprobe nvidia_modprobe//kmod 0 profiles are in complain mode. 0 profiles are in kill mode. 0 profiles are in unconfined mode. 0 processes have profiles defined. 0 processes are in enforce mode. 0 processes are in complain mode. 0 processes are unconfined but have a profile defined. 0 processes are in mixed mode. 0 processes are in kill mode. # configuration files of each profile are under the directory below root@dlp:~# ll /etc/apparmor.d total 40 drwxr-xr-x 2 root root 4096 Jun 11 19:27 abi drwxr-xr-x 4 root root 4096 Jun 11 19:27 abstractions drwxr-xr-x 2 root root 4096 Feb 14 05:49 disable drwxr-xr-x 2 root root 4096 Feb 14 05:49 force-complain drwxr-xr-x 2 root root 4096 Jun 11 19:30 local -rw-r--r-- 1 root root 1379 Feb 14 05:49 lsb_release -rw-r--r-- 1 root root 1189 Feb 14 05:49 nvidia_modprobe -rw-r--r-- 1 root root 3461 Mar 30 04:02 sbin.dhclient drwxr-xr-x 5 root root 4096 Jun 11 19:27 tunables -rw-r--r-- 1 root root 3448 Mar 12 17:23 usr.bin.man |
[2] | If you'd like to disable AppArmor itself, configure like follows. |
# unload current all loaded profiles root@dlp:~# aa-teardown Unloading AppArmor profiles
root@dlp:~#
aa-status apparmor module is loaded. # disable loading profiles when system booting root@dlp:~# systemctl disable apparmor Synchronizing state of apparmor.service with SysV service script with /lib/systemd/systemd-sysv-install. Executing: /lib/systemd/systemd-sysv-install disable apparmor Removed /etc/systemd/system/sysinit.target.wants/apparmor.service. |
Sponsored Link |
|