Differences between revisions 5 and 7 (spanning 2 versions)
Revision 5 as of 2013-04-05 15:19:33
Size: 1213
Editor: ?IntRigeri
Comment: Improve wording and typesetting.
Revision 7 as of 2014-06-14 23:36:43
Size: 1586
Editor: TheAnarcat
Comment:
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
#language en
~-[[DebianWiki/EditorGuide#translation|Translation(s)]]: none-~
----
Line 3: Line 6:
A Debian 7.0 (Wheezy) or newer GNU/Linux system is required. A Debian 7 "Wheezy" or newer GNU/Linux system is required.
Line 7: Line 10:
Install AppArmor userspace tools and some contributed profiles: Install !AppArmor userspace tools and some contributed profiles:
Line 15: Line 18:
Enable the AppArmor LSM: Enable the !AppArmor LSM:
Line 25: Line 28:
See what running executables are currently confined by an AppArmor profile: See what running executables are currently confined by an !AppArmor profile:
Line 35: Line 38:
 * in the `apparmor-profiles` package;  * in the DebianPkg:apparmor-profiles package;
Line 39: Line 42:
Once you've dropped the new profile into `/etc/apparmor.d/`, use `apparmor_parser(8)` to insert it into the kernel. Once you've dropped the new profile into `/etc/apparmor.d/`, use [[DebianMan:8/apparmor_parser|apparmor_parser(8)]] to insert it into the kernel.
Line 41: Line 44:
AppArmor audit logs can be found in `/var/log/kern.log`. For example, to enable all "extra" profiles provided in the apparmor-profiles package, do the following:

{{{
cd /usr/share/doc/apparmor-profiles/extras
cp -i *.* /etc/apparmor.d/
for f in *.* ; do aa-complain /etc/apparmor.d/$f; done
}}}

!AppArmor audit logs can be found in `/var/log/kern.log`.

Translation(s): none


Requirements

A Debian 7 "Wheezy" or newer GNU/Linux system is required.

Install software

Install AppArmor userspace tools and some contributed profiles:

$ sudo apt-get install apparmor apparmor-profiles apparmor-utils

Enable AppArmor

Enable the AppArmor LSM:

$ sudo perl -pi -e 's,GRUB_CMDLINE_LINUX="(.*)"$,GRUB_CMDLINE_LINUX="$1 apparmor=1 security=apparmor",' /etc/default/grub
$ sudo update-grub
$ sudo reboot

Inspect the current state

See what running executables are currently confined by an AppArmor profile:

$ ps auxZ | grep -v '^unconfined'

Enable / install more profiles

Find more profiles:

Once you've dropped the new profile into /etc/apparmor.d/, use apparmor_parser(8) to insert it into the kernel.

For example, to enable all "extra" profiles provided in the apparmor-profiles package, do the following:

cd /usr/share/doc/apparmor-profiles/extras
cp -i *.* /etc/apparmor.d/
for f in *.* ; do aa-complain /etc/apparmor.d/$f; done

AppArmor audit logs can be found in /var/log/kern.log.

Learn more

See the "External links" section on the main AppArmor page.