AppArmor : Enable / Disable AppArmor2026/06/11

This is the Basic Usage and Configuration for AppArmor (Application Armor).

It's possible to use MAC (Mandatory Access Control) feature on Ubuntu for various resources by AppArmor.

[1]

Display the current status of AppArmor to use AppArmor.
(Follow is the status of default settings after installing Ubuntu)

# show status
# 13 profiles are loaded in [enforce] mode

root@dlp:~#

aa-status

pparmor module is loaded.
181 profiles are loaded.
105 profiles are in enforce mode.
   /usr/bin/man
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/chronyd
   alsamixer
   babeld
   bfdd
   bgpd
   bwrap
   dig
   dnstracer
.....
.....

# configuration files of each profile are under the directory below

root@dlp:~#

ll /etc/apparmor.d

total 688
drwxr-xr-x   9 root root  4096 Apr 20 18:22 ./
drwxr-xr-x 110 root root  4096 Jun 10 23:55 ../
-rw-r--r--   1 root root   373 Apr  8 17:26 1password
-rw-r--r--   1 root root   371 Apr  8 17:26 Discord
-rw-r--r--   1 root root   405 Apr  8 17:26 MongoDB_Compass
-rw-r--r--   1 root root   440 Apr  8 17:26 QtWebEngineProcess
-rw-r--r--   1 root root  4521 Apr  8 17:26 Xorg
drwxr-xr-x   2 root root  4096 Apr 20 18:07 abi/
drwxr-xr-x   4 root root  4096 Apr 20 18:07 abstractions/
-rw-r--r--   1 root root  1274 Apr  8 17:26 alsamixer
-rw-r--r--   1 root root   721 Apr  8 17:26 babeld
.....
.....

[2]	If you'd like to disable AppArmor itself, configure like follows.

# unload current all loaded profiles

root@dlp:~#

aa-teardown

Unloading AppArmor profiles

root@dlp:~#

aa-status

apparmor module is loaded.
No policy loaded into the kernel
0 profiles are loaded.
0 profiles are in enforce mode.
0 profiles are in complain mode.
0 profiles are in prompt mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are in prompt mode.
0 processes are in kill mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.

# disable loading profiles when system booting

root@dlp:~#

systemctl disable apparmor

Synchronizing state of apparmor.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install disable apparmor
Removed /etc/systemd/system/sysinit.target.wants/apparmor.service.

# otherwise, to completely disable, add kernel parameter

root@dlp:~#

vi /etc/default/grub

# line 11 : add

GRUB_CMDLINE_LINUX="

apparmor=0

root@dlp:~#

update-grub

Matched Content