AppArmor / SELinux
high on-server
What it inspects
First `aa-status` as root: AppArmor with at least one enforcing profile passes; loaded with profiles only in complain mode warns; loaded with none, or not loaded, fails. If aa-status is not available it runs `getenforce`: Enforcing passes, Permissive warns, Disabled fails; any other result, or neither tool present, is skipped.
Why it matters
A mandatory access control framework limits what a compromised process can touch, so a bug in one service does not automatically mean control of the whole machine. It is often switched off to make something work, which removes that second line of defence. Fix the specific denial instead.
How to verify
# Debian/Ubuntu:
sudo aa-status
# RHEL family:
getenforce; sestatus
How to fix
Debian/Ubuntu: install and start AppArmor, then enforce profiles one at a time. RHEL family: test in permissive mode and relabel first; never switch SELinux off.
Start AppArmor (Debian/Ubuntu) or check SELinux state (RHEL family)
Debian / Ubuntu
# Debian/Ubuntu: installs AppArmor and its tools and starts it, which loads the packaged profiles in enforce mode.
# If the final command says the module is not loaded, the kernel was started without AppArmor: see step 4.
# BEFORE re-enabling it on a host where someone switched AppArmor off to get a service working: look in
# /etc/apparmor.d for a profile that matches that service (ls /etc/apparmor.d), and put it in complain mode first:
# aa-complain <profile>
# After the next restarts of that service, watch for denials: journalctl -k | grep -i apparmor
apt-get install -y apparmor apparmor-utils
systemctl enable --now apparmor
aa-status
RHEL / Rocky / Alma / Fedora
# RHEL family: this step only installs the SELinux tools and shows the current state. It changes no mode.
# Switching SELinux to enforcing needs a testing pass first: see step 3.
dnf install -y libselinux-utils policycoreutils policycoreutils-python-utils audit
getenforce
sestatus
grep -E '^SELINUX=' /etc/selinux/config
- Move AppArmor profiles from complain to enforce
- Switch SELinux to enforcing with a testing pass and relabel
- Enable AppArmor in the kernel command line
3 more steps in the Fix Pack. See pricing