AppArmor : Enable / Disable AppArmor2023/07/13 |
|
This is the Basic Usage and Configuration for AppArmor (Application Armor).
It's possible to use MAC (Mandatory Access Control) feature on Ubuntu for various resources by AppArmor.
|
|
| [1] | Display the current status of AppArmor to use AppArmor. (Follow is the status of default settings after installing Ubuntu) |
|
# show status # 13 profiles are loaded in [enforce] mode root@dlp:~# aa-status
apparmor module is loaded.
10 profiles are loaded.
10 profiles are in enforce mode.
/usr/bin/man
/usr/lib/NetworkManager/nm-dhcp-client.action
/usr/lib/NetworkManager/nm-dhcp-helper
/usr/lib/connman/scripts/dhclient-script
/{,usr/}sbin/dhclient
lsb_release
man_filter
man_groff
nvidia_modprobe
nvidia_modprobe//kmod
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.
# configuration files of each profile are under the directory below root@dlp:~# ll /etc/apparmor.d total 40 drwxr-xr-x 2 root root 4096 Jun 11 19:27 abi drwxr-xr-x 4 root root 4096 Jun 11 19:27 abstractions drwxr-xr-x 2 root root 4096 Feb 14 05:49 disable drwxr-xr-x 2 root root 4096 Feb 14 05:49 force-complain drwxr-xr-x 2 root root 4096 Jun 11 19:30 local -rw-r--r-- 1 root root 1379 Feb 14 05:49 lsb_release -rw-r--r-- 1 root root 1189 Feb 14 05:49 nvidia_modprobe -rw-r--r-- 1 root root 3461 Mar 30 04:02 sbin.dhclient drwxr-xr-x 5 root root 4096 Jun 11 19:27 tunables -rw-r--r-- 1 root root 3448 Mar 12 17:23 usr.bin.man |
| [2] | If you'd like to disable AppArmor itself, configure like follows. |
|
# unload current all loaded profiles root@dlp:~# aa-teardown Unloading AppArmor profiles
root@dlp:~#
aa-status apparmor module is loaded. # disable loading profiles when system booting root@dlp:~# systemctl disable apparmor Synchronizing state of apparmor.service with SysV service script with /lib/systemd/systemd-sysv-install. Executing: /lib/systemd/systemd-sysv-install disable apparmor Removed /etc/systemd/system/sysinit.target.wants/apparmor.service. |
| Sponsored Link |
|
|