AppArmor : Enable / Disable Profiles2023/07/13

	It's possible to enable or disable each profile if you don't need.
[1]	Install a package which includes tools for AppArmor settings.

root@dlp:~#

apt -y install apparmor-utils

[2]	Disable a profile which is currently loaded.

root@dlp:~#

aa-status

apparmor module is loaded.
10 profiles are loaded.
10 profiles are in enforce mode.
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /{,usr/}sbin/dhclient
   lsb_release
   man_filter
   man_groff
   nvidia_modprobe
   nvidia_modprobe//kmod
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.

# configuration files for each profile are under the directory below

root@dlp:~#

ll /etc/apparmor.d

total 40
drwxr-xr-x 2 root root 4096 Jun 11 19:27 abi
drwxr-xr-x 4 root root 4096 Jun 11 19:27 abstractions
drwxr-xr-x 2 root root 4096 Feb 14 05:49 disable
drwxr-xr-x 2 root root 4096 Feb 14 05:49 force-complain
drwxr-xr-x 2 root root 4096 Jun 11 19:30 local
-rw-r--r-- 1 root root 1379 Feb 14 05:49 lsb_release
-rw-r--r-- 1 root root 1189 Feb 14 05:49 nvidia_modprobe
-rw-r--r-- 1 root root 3461 Mar 30 04:02 sbin.dhclient
drwxr-xr-x 5 root root 4096 Jun 11 19:27 tunables
-rw-r--r-- 1 root root 3448 Mar 12 17:23 usr.bin.man

# for example, disable [/usr/bin/man]

root@dlp:~#

aa-disable /usr/bin/man

Disabling /usr/bin/man.

root@dlp:~#

aa-status

apparmor module is loaded.
7 profiles are loaded.
7 profiles are in enforce mode.
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /{,usr/}sbin/dhclient
   lsb_release
   nvidia_modprobe
   nvidia_modprobe//kmod
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.

# disabled profile is moved to the directory below

root@dlp:~#

ll /etc/apparmor.d/disable

total 0
lrwxrwxrwx 1 root root 27 Jul 12 19:34 usr.bin.man -> /etc/apparmor.d/usr.bin.man

[3]	Enable a profile which is currently disabled.

root@dlp:~#

aa-status

apparmor module is loaded.
7 profiles are loaded.
7 profiles are in enforce mode.
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /{,usr/}sbin/dhclient
   lsb_release
   nvidia_modprobe
   nvidia_modprobe//kmod
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.

# for example, enable [/usr/bin/man] with [enforce] mode
# [enforce] mode : allow only actions that are defined in a profile
# [complain] mode : denied actions are logged but they are not actually denied

root@dlp:~#

aa-enforce /usr/bin/man

Setting /usr/bin/man to enforce mode.

root@dlp:~#

aa-status

apparmor module is loaded.
10 profiles are loaded.
10 profiles are in enforce mode.
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /{,usr/}sbin/dhclient
   lsb_release
   man_filter
   man_groff
   nvidia_modprobe
   nvidia_modprobe//kmod
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.

Matched Content