Differences between revisions 27 and 29 (spanning 2 versions)
Revision 27 as of 2015-01-29 16:13:46
Size: 2658
Editor: UlrikeUhlig
Comment: dont show children in nav
Revision 29 as of 2015-01-29 17:26:48
Size: 2682
Editor: UlrikeUhlig
Deletions are marked like this. Additions are marked like this.
Line 3: Line 3:
~-[[DebianWiki/EditorGuide#translation|Translation(s)]]: none-~
~-[[DebianWiki/EditorGuide#translation|Translation(s)]]: none-~<<Navigation(siblings,1)>>
Line 67: Line 65:
== Debug ==
Line 69: Line 69:
== Debug ==

lease read the dedicated documentation for [[AppArmor/Debug|debugging AppArmor]].
For more detailed instructions, please read the dedicated documentation for [[AppArmor/Debug|debugging AppArmor]].

Translation(s): none


A Debian 7 "Wheezy" or newer GNU/Linux system is required.

If you are using wheezy, upgrading to systemd 204-14 from wheezy-backports is recommended, but not mandatory.

Install software

Install AppArmor userspace tools and some contributed profiles:

$ sudo apt-get install apparmor apparmor-profiles apparmor-utils

Enable AppArmor

Enable the AppArmor LSM:

$ sudo perl -pi -e 's,GRUB_CMDLINE_LINUX="(.*)"$,GRUB_CMDLINE_LINUX="$1 apparmor=1 security=apparmor",' /etc/default/grub
$ sudo update-grub
$ sudo reboot

In the future, this should be automated, see #702030

Inspect the current state

$ sudo aa-status

will list all loaded AppArmor profiles for applications and processes and detail their status (enforced, complain, unconfined).

$ ps auxZ | grep -v '^unconfined'

will list running executables which are currently confined by an AppArmor profile.

Enable / install more profiles

Find more profiles:

Once you've dropped the new profile (this is automated when installing the apparmor-profiles or the apparmor-profiles-extra package) into /etc/apparmor.d/, use apparmor_parser(8) to insert it into the kernel.

For example, to set all "extra" profiles (provided in the apparmor-profiles package) to complain mode (security policy is not enforced, but corresponding access violations are logged), do the following:

cd /usr/share/doc/apparmor-profiles/extras
cp -i *.* /etc/apparmor.d/
for f in *.* ; do aa-complain /etc/apparmor.d/$f; done

To set these profiles to enforce mode, use aa-enforce instead of aa-complain. Note that many of these profiles are not up-to-date and might break functionality in enforce mode.


AppArmor audit logs can be found in /var/log/syslog.

For more detailed instructions, please read the dedicated documentation for debugging AppArmor.

Learn more

Learn more or start contributing.