Debian AppArmor Tutorial

1. Does Debian use AppArmor?
2. Should I disable AppArmor?
3. How do I set up AppArmor?
4. How do I write a AppArmor profile?
5. How do I check my AppArmor status?
6. Does Debian use SELinux?
7. How do I stop AppArmor?
8. What is AppArmor in Linux?
9. How do I debug AppArmor?
10. What are AppArmor profiles?
11. Where are AppArmor profiles stored?
12. How do I restart AppArmor?

Does Debian use AppArmor?

AppArmor is available in Debian since Debian 7 "Wheezy". Install AppArmor userspace tools: apparmor.

Should I disable AppArmor?

AppArmor has the ability to disable specific profiles rather than simply turning it on or off, yet I've seen people in IRC and forums advise others to disable AppArmor completely. This is totally misguided and YOU SHOULD NEVER DISABLE APPARMOR ENTIRELY to work around a profiling problem.

How do I set up AppArmor?

To set a profile in complain mode, first install apparmor-utils package if it is not already installed. Use aa-complain command to set a profile in complain mode. For example, do the following to enable complain mode for mysqld. $ sudo aa-complain /usr/sbin/mysqld Setting /usr/sbin/mysqld to complain mode.

How do I write a AppArmor profile?

Build an AppArmor profile for a group of applications as follows:

1. Create profiles for the individual programs that make up your application. ...
2. Put relevant profiles into learning or complain mode. ...
3. Exercise your application. ...
4. Analyze the log. ...
5. Repeat Step 3 and Step 4. ...
6. Edit the profiles. ...
7. Return to enforce mode.

How do I check my AppArmor status?

To check AppArmor status we use the command aa-status. This command will show the various information like the list of loaded AppArmor module, current AppArmor policy, the command requires sudo to access.

Does Debian use SELinux?

The Debian packaged Linux kernels have SELinux support compiled in, but disabled by default. To enable it, see the Setup Notes.

How do I stop AppArmor?

To disable AppArmor in the kernel to either:

1. adjust your kernel boot command line (see /etc/default/grub) to include either.
2. * 'apparmor=0'
3. * 'security=XXX' where XXX can be "" to disable AppArmor or an alternative LSM name, eg. 'security="selinux"'
4. remove the apparmor package with your package manager.

What is AppArmor in Linux?

AppArmor is a Mandatory Access Control (MAC) system which is a kernel (LSM) enhancement to confine programs to a limited set of resources. AppArmor's security model is to bind access control attributes to programs rather than to users. ... Core AppArmor functionality is in the mainline Linux kernel from 2.6.

How do I debug AppArmor?

Debugging procedure

1. To debug an apparmor profile, look in /var/log/kern.log for 'audit' entries. ...
2. where '/path/to/bin' is the absolute path to the binary, as reported in the 'profile=...' ...
3. To re-enable enforcing mode, use 'aa-enforce' instead: sudo aa-enforce /path/to/bin.

What are AppArmor profiles?

AppArmor profiles are stored in /etc/apparmor.d/ and they contain a list of access control rules on resources that each program can make use of. The profiles are compiled and loaded into the kernel by the apparmor_parser command. Each profile can be loaded either in enforcing or complaining mode.

Where are AppArmor profiles stored?

Where is AppArmor Policy Stored? AppArmor system profile files and related files are traditionally stored in the directory /etc/apparmor.

How do I restart AppArmor?

1. Task: Stop Apparmor. Type the following command: ## debian/ubuntu sudo /etc/init.d/apparmor stop ## Suse /etc/init.d/boot.apparmor stop.
2. Task: Start Apparmor. Type the following command: ...
3. Task: Restart Apparmor. Type the following command: ...
4. Task: See the current Apparmor status. Type the following command: