4.5 Activate AppArmor - 'Profiles are loaded' - Review


AppArmor provides a Mandatory Access Control (MAC) system that greatly augments the
default Discretionary Access Control (DAC) model.


For an action to occur, both the traditional DAC permissions must be satisfied as well as the
AppArmor MAC rules. The action will not be allowed if either one of these models does not
permit the action. In this way, AppArmor rules can only make a system's permissions more
restrictive and secure.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.


Install apparmor and apparmor-utils if missing (additional profiles can be found in the
apparmor-profiles package)-# apt-get install apparmor apparmor-utilsRemove apparmor=0 from all kernels in /boot/grub/menu.lst-kernel /boot/vmlinuz-3.0.80-0.7-ec2 root=/dev/sda1 xencons=xvc0 console=xvc0
splash=silent showoptsSet all profiles to enforce mode-# aa-enforce /etc/apparmor.d/*Any unconfined processes may need to have a profile created or activated for them and
then be restarted.

See Also


Item Details


References: 800-53|AC-3(3)

Plugin: Unix

Control ID: c648f2f284703987ebf1bfbcb54b03b0b762c93f714d46b48872ecf7472c0e95