Differences between revisions 13 and 14
Revision 13 as of 2014-08-29 03:24:54
Size: 1951
Editor: ?IntRigeri
Comment: Adjust one more URL to match organizational changes.
Revision 14 as of 2014-09-16 14:37:34
Size: 2023
Editor: HolgerLevsen
Comment: nowadays more profiles can be installed from packages..
Deletions are marked like this. Additions are marked like this.
Line 42: Line 42:
 * in the DebianPkg:apparmor-profiles-extra package;  * in the DebianPkg:apparmor-profiles-extra package (available in wheezy-backports and jessie);
Line 46: Line 46:
Once you've dropped the new profile into `/etc/apparmor.d/`, use [[DebianMan:8/apparmor_parser|apparmor_parser(8)]] to insert it into the kernel. Once you've dropped the new profile (eg by installing a package) into `/etc/apparmor.d/`, use [[DebianMan:8/apparmor_parser|apparmor_parser(8)]] to insert it into the kernel.

Translation(s): none


A Debian 7 "Wheezy" or newer GNU/Linux system is required.

If you are using wheezy, upgrading to systemd 204-14 from wheezy-backports is recommended, but not mandatory.

Install software

Install AppArmor userspace tools and some contributed profiles:

$ sudo apt-get install apparmor apparmor-profiles apparmor-utils

Enable AppArmor

Enable the AppArmor LSM:

$ sudo perl -pi -e 's,GRUB_CMDLINE_LINUX="(.*)"$,GRUB_CMDLINE_LINUX="$1 apparmor=1 security=apparmor",' /etc/default/grub
$ sudo update-grub
$ sudo reboot

Inspect the current state

See what running executables are currently confined by an AppArmor profile:

$ ps auxZ | grep -v '^unconfined'
$ sudo aa-status

Enable / install more profiles

Find more profiles:

Once you've dropped the new profile (eg by installing a package) into /etc/apparmor.d/, use apparmor_parser(8) to insert it into the kernel.

For example, to set all "extra" profiles (provided in the apparmor-profiles package) to complain mode (security policy is not enforced, but corresponding access violations are logged), do the following:

cd /usr/share/doc/apparmor-profiles/extras
cp -i *.* /etc/apparmor.d/
for f in *.* ; do aa-complain /etc/apparmor.d/$f; done

To set these profiles to enforce mode, use aa-enforce instead of aa-complain.

AppArmor audit logs can be found in /var/log/syslog.

Learn more

See the "External links" section on the main AppArmor page.