Install and enable AppArmor

Description

AppArmor is the mandatory access control (MAC) system of Ubuntu. It confines programs with per-program profiles that list the files, capabilities and network access they may use, on top of the classic Unix permissions. It needs the apparmor package (parser and profiles) and the AppArmor security module enabled in the running kernel.

AppArmor is the default security module of the Ubuntu kernels, so no apparmor=1 or security=apparmor boot parameter is needed. If it was disabled with apparmor=0 or a security= / lsm= kernel parameter, remove that parameter from GRUB_CMDLINE_LINUX in /etc/default/grub, run update-grub and reboot.

Rationale

Unix permissions only depend on the user a program runs as. A compromised service confined by an AppArmor profile cannot read or write outside what its profile allows, even as root, which limits what an attacker can do after exploiting it.

Impact

None known on a default install: Ubuntu ships AppArmor installed and enabled on every release, and its profiles are written not to break the packaged programs.

Setting

Audit

1. Run dpkg -s apparmor. The package must be installed.
2. Run aa-enabled. It must print Yes.

Automated: every check must pass. Scanners report each check by its id.

package

The apparmor package is installed.

name: apparmor
state: installed

enabled

The AppArmor kernel module reports itself enabled.

path: /sys/module/apparmor/parameters/enabled
pattern: ^Y$

Remediation

1. Install the package: apt install apparmor.
2. If aa-enabled still says it is disabled, remove apparmor=0, security= or lsm= from the kernel command line in /etc/default/grub, run update-grub and reboot.

Rollback

AppArmor can be disabled for one boot with the apparmor=0 kernel parameter.

install

Generated from check package: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• Ubuntu Server documentation - AppArmor Canonical, vendor-doc, accessed 2026-10-19
• aa-status(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R45) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-UBU-BOOT-010 Keep no AppArmor profile in complain mode

People and lifecycle