AppArmor : Enable / Disable Profiles2026/06/11 |
|
It's possible to enable or disable each profile if you don't need. |
|
| [1] | Install a package which includes tools for AppArmor settings. |
|
root@dlp:~# apt -y install apparmor-utils
|
| [2] | Disable a profile which is currently loaded. |
|
root@dlp:~# aa-status apparmor module is loaded. 181 profiles are loaded. 105 profiles are in enforce mode. /usr/bin/man /usr/lib/snapd/snap-confine /usr/lib/snapd/snap-confine//mount-namespace-capture-helper /usr/sbin/chronyd alsamixer babeld bfdd bgpd bwrap ..... ..... # configuration files for each profile are under the directory below root@dlp:~# ll /etc/apparmor.d total 688 drwxr-xr-x 9 root root 4096 Apr 20 18:22 ./ drwxr-xr-x 110 root root 4096 Jun 10 23:55 ../ -rw-r--r-- 1 root root 373 Apr 8 17:26 1password -rw-r--r-- 1 root root 371 Apr 8 17:26 Discord -rw-r--r-- 1 root root 405 Apr 8 17:26 MongoDB_Compass -rw-r--r-- 1 root root 440 Apr 8 17:26 QtWebEngineProcess -rw-r--r-- 1 root root 4521 Apr 8 17:26 Xorg drwxr-xr-x 2 root root 4096 Apr 20 18:07 abi/ drwxr-xr-x 4 root root 4096 Apr 20 18:07 abstractions/ -rw-r--r-- 1 root root 1274 Apr 8 17:26 alsamixer ..... ..... # for example, disable [/usr/bin/man] root@dlp:~# aa-disable /usr/bin/man Disabling /usr/bin/man. aa-status apparmor module is loaded. 178 profiles are loaded. 102 profiles are in enforce mode. /usr/lib/snapd/snap-confine /usr/lib/snapd/snap-confine//mount-namespace-capture-helper /usr/sbin/chronyd alsamixer babeld bfdd bgpd bwrap dig dnstracer eigrpd fabricd ..... ..... # disabled profile is moved to the directory below root@dlp:~# ll /etc/apparmor.d/disable total 8 drwxr-xr-x 2 root root 4096 Jun 11 00:13 ./ drwxr-xr-x 9 root root 4096 Apr 20 18:22 ../ lrwxrwxrwx 1 root root 27 Jun 11 00:13 usr.bin.man@ -> /etc/apparmor.d/usr.bin.man |
| [3] | Enable a profile which is currently disabled. |
|
root@dlp:~# aa-status apparmor module is loaded. 178 profiles are loaded. 102 profiles are in enforce mode. /usr/lib/snapd/snap-confine /usr/lib/snapd/snap-confine//mount-namespace-capture-helper /usr/sbin/chronyd alsamixer babeld bfdd bgpd bwrap dig dnstracer eigrpd fabricd ..... ..... # for example, enable [/usr/bin/man] with [enforce] mode # [enforce] mode : allow only actions that are defined in a profile # [complain] mode : denied actions are logged but they are not actually denied root@dlp:~# aa-enforce /usr/bin/man Setting /usr/bin/man to enforce mode. aa-status apparmor module is loaded. 181 profiles are loaded. 105 profiles are in enforce mode. /usr/bin/man /usr/lib/snapd/snap-confine /usr/lib/snapd/snap-confine//mount-namespace-capture-helper /usr/sbin/chronyd alsamixer babeld bfdd bgpd bwrap dig dnstracer eigrpd ..... ..... |
| Sponsored Link |
|
|