Linux · 2023-03-22

Enable / Disable AppArmor

[1] Display thye current status of AppArmor to use AppArmor. (Follow is the status of default settings after installing Ubuntu)
# show status # 13 profiles are loaded in [enforce] mode
root@dlp:~#
aa-status
apparmor module is loaded.
13 profiles are loaded.
13 profiles are in enforce mode.
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /{,usr/}sbin/dhclient
   lsb_release
   man_filter
   man_groff
   nvidia_modprobe
   nvidia_modprobe//kmod
   tcpdump
0 profiles are in complain mode.
0 profiles are in kill mode.
0 profiles are in unconfined mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
0 processes are in mixed mode.
0 processes are in kill mode.
# configration files of each profile are under the directory below
root@dlp:~#
ll /etc/apparmor.d
total 92
drwxr-xr-x  8 root root  4096 Dec  8 10:33 ./
drwxr-xr-x 97 root root  4096 Dec 15 11:14 ../
drwxr-xr-x  2 root root  4096 Sep 19 12:51 abi/
drwxr-xr-x  4 root root 12288 Sep 19 12:51 abstractions/
drwxr-xr-x  2 root root  4096 Apr 21  2022 disable/
drwxr-xr-x  2 root root  4096 Mar 10  2022 force-complain/
drwxr-xr-x  2 root root  4096 Sep 19 12:51 local/
-rw-r--r--  1 root root  1339 Mar 10  2022 lsb_release
-rw-r--r--  1 root root  1189 Mar 10  2022 nvidia_modprobe
-rw-r--r--  1 root root  3461 Jul 19 16:54 sbin.dhclient
drwxr-xr-x  5 root root  4096 Sep 19 12:51 tunables/
-rw-r--r--  1 root root  3448 Mar 18  2022 usr.bin.man
-rw-r--r--  1 root root  1421 Jun 21  2021 usr.bin.tcpdump
-rw-r--r--  1 root root 28486 Nov 28 13:53 usr.lib.snapd.snap-confine.real
-rw-r--r--  1 root root  1592 Nov 16  2021 usr.sbin.rsyslogd
[2] If you’d like to disable AppArmor itself, configure like follows.
# unload current all loaded profiles
root@dlp:~#
aa-teardown
Unloading AppArmor profiles
root@dlp:~#
aa-status
apparmor module is loaded.
# disable loading profiles when system booting
root@dlp:~#
systemctl disable apparmor
Synchronizing state of apparmor.service with SysV service script with /lib/systemd/systemd-sysv-install. Executing: /lib/systemd/systemd-sysv-install disable apparmor Removed /etc/systemd/system/sysinit.target.wants/apparmor.service.