Install and enable AppArmor

Description

AppArmor is the mandatory access control (MAC) system of Debian. It confines programs with per-program profiles that list the files, capabilities and network access they may use, on top of the classic Unix permissions. It needs the apparmor package (parser and profiles) and the AppArmor security module enabled in the running kernel.

AppArmor is enabled by the Debian kernel by default. If it was disabled with apparmor=0 or a security= / lsm= kernel parameter, remove that parameter from GRUB_CMDLINE_LINUX in /etc/default/grub, run update-grub and reboot.

Rationale

Unix permissions only depend on the user a program runs as. A compromised service confined by an AppArmor profile cannot read or write outside what its profile allows, even as root, which limits what an attacker can do after exploiting it.

Impact

None known on a default install: Debian ships AppArmor enabled since Debian 10, and its profiles are written not to break the packaged programs.

Setting

Audit

1. Run dpkg -s apparmor. The package must be installed.
2. Run aa-enabled. It must print Yes.

Automated: every check must pass. Scanners report each check by its id.

package

The apparmor package is installed.

name: apparmor
state: installed

enabled

The AppArmor kernel module reports itself enabled.

path: /sys/module/apparmor/parameters/enabled
pattern: ^Y$

Remediation

1. Install the package: apt install apparmor.
2. If aa-enabled still says it is disabled, remove apparmor=0, security= or lsm= from the kernel command line in /etc/default/grub, run update-grub and reboot.

Rollback

AppArmor can be disabled for one boot with the apparmor=0 kernel parameter.

install

Generated from check package: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• Debian Wiki - AppArmor/HowToUse Debian, vendor-doc, accessed 2026-10-18
• aa-status(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R45) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-BOOT-010 Keep no AppArmor profile in complain mode

People and lifecycle