| [1] | Display thye current status of AppArmor to use AppArmor. (Follow is the status of default settings after installing Ubuntu) |
|
# show status
# 13 profiles are loaded in [enforce] mode root@dlp:~# aa-status
apparmor module is loaded.
13 profiles are loaded.
13 profiles are in enforce mode.
/usr/bin/man
/usr/lib/NetworkManager/nm-dhcp-client.action
/usr/lib/NetworkManager/nm-dhcp-helper
/usr/lib/connman/scripts/dhclient-script
/usr/lib/snapd/snap-confine
/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
/{,usr/}sbin/dhclient
lsb_release
man_filter
man_groff
nvidia_modprobe
nvidia_modprobe//kmod
tcpdump
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.
# configration files of each profile are under the directory below
root@dlp:~# ll /etc/apparmor.d
total 92 drwxr-xr-x 8 root root 4096 Dec 8 10:33 ./ drwxr-xr-x 97 root root 4096 Dec 15 11:14 ../ drwxr-xr-x 2 root root 4096 Sep 19 12:51 abi/ drwxr-xr-x 4 root root 12288 Sep 19 12:51 abstractions/ drwxr-xr-x 2 root root 4096 Apr 21 2022 disable/ drwxr-xr-x 2 root root 4096 Mar 10 2022 force-complain/ drwxr-xr-x 2 root root 4096 Sep 19 12:51 local/ -rw-r--r-- 1 root root 1339 Mar 10 2022 lsb_release -rw-r--r-- 1 root root 1189 Mar 10 2022 nvidia_modprobe -rw-r--r-- 1 root root 3461 Jul 19 16:54 sbin.dhclient drwxr-xr-x 5 root root 4096 Sep 19 12:51 tunables/ -rw-r--r-- 1 root root 3448 Mar 18 2022 usr.bin.man -rw-r--r-- 1 root root 1421 Jun 21 2021 usr.bin.tcpdump -rw-r--r-- 1 root root 28486 Nov 28 13:53 usr.lib.snapd.snap-confine.real -rw-r--r-- 1 root root 1592 Nov 16 2021 usr.sbin.rsyslogd |
| [2] | If you’d like to disable AppArmor itself, configure like follows. |
|
# unload current all loaded profiles
root@dlp:~# aa-teardown
Unloading AppArmor profiles root@dlp:~#
aa-status
apparmor module is loaded. # disable loading profiles when system booting
root@dlp:~# systemctl disable apparmor
Synchronizing state of apparmor.service with SysV service script with /lib/systemd/systemd-sysv-install. |