apparmor — AppArmor¶
Debian and Ubuntu confine many services with AppArmor. An upgrade can bring profiles that don't fit your configuration (and start denying), or leave profiles unloaded.
At a glance
| ID | apparmor |
| Category | Security |
| Needs root | yes (skipped without it) |
| Needs programs | none |
| Compares with a snapshot | yes |
| Options | 0 |
What it checks¶
- Whether AppArmor is enabled in the kernel.
- Profiles in complain mode (logging instead of blocking).
- Denials in the kernel log this boot, grouped by profile and operation.
- With a snapshot: profiles that were enforced and now aren't (in complain mode, or no longer loaded).
Findings¶
| Severity | Finding | What to do |
|---|---|---|
| warning | AppArmor is disabled | Check the kernel command line (apparmor=0, security=); sudo systemctl enable --now apparmor. |
| warning | N AppArmor denials this boot | sudo journalctl -b -k --grep='apparmor="DENIED"'; a profile from the new release may not fit your configuration. |
| warning | N AppArmor profiles are no longer enforced | sudo aa-status; sudo aa-enforce PROFILE. |
| info | N AppArmor profiles are in complain mode | sudo aa-enforce PROFILE once it no longer logs denials. |
Compared with a snapshot¶
The snapshot records whether AppArmor was enabled and each profile's mode.
Commands it runs¶
Profiles and their modes are read from /sys/kernel/security/apparmor/profiles.
Limitations¶
- Needs root to read the profile list.
- Denials are read from the journal; without journald, only the profile part runs.
- Skipped when the kernel has no AppArmor support.
Options¶
This check has no options. Turn it off with enabled: false under checks: apparmor: in the configuration file, or for one run with --skip apparmor.