# AppArmor Issues on EndeavourOS (Standard and LTS Kernels) - Seeking Community Input **URL:** \ **Category:** Kernel, boot, graphics & hardware\ **Created:** [May 3, 2025, 9:10pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963 "2025-05-03T21:10:12Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![manyroads](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/manyroads/32/5885_2.png) [@manyroads](https://forum.endeavouros.com/u/manyroads)\ **Post date:** [May 3, 2025, 9:10pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/1 "2025-05-03T21:10:12Z")
Hello EndeavourOS community, I’ve been trying to enable AppArmor on my system to enhance security. I’m running EndeavourOS with two kernels installed: the standard `linux` kernel (currently 6.14.4-arch1-2) and the LTS kernel (`linux-lts` 6.12.26-1). After installing the `apparmor` userspace tools, I’ve encountered a persistent issue where the AppArmor filesystem (`securityfs`) does not appear to be mounted. This is preventing the `apparmor.service` from starting, as it fails the `ConditionSecurity=apparmor` check. Here’s a summary of the troubleshooting steps I’ve taken, with the assistance of online documentation and AI support: - `aa-status` consistently reports “apparmor filesystem is not mounted.” - Manually attempting to mount `securityfs` using `sudo mount -t securityfs ...` did not result in a persistent mount. - Adding `securityfs /sys/kernel/security securityfs defaults 0 0` to `/etc/fstab` did not automatically mount it on reboot. - Checking the status of the `apparmor.service` with `systemctl status apparmor.service` shows it as inactive (dead) with the condition “ConditionSecurity=apparmor was not met.” - Crucially, I’ve been unable to find the `apparmor` kernel module (`.ko.xz` file) in the expected location (`/lib/modules/$(uname -r)/kernel/security/`) for _both_ the standard and LTS kernels. A search using `sudo find /lib/modules/$(uname -r)/ -name "apparmor*"` only reveals build directories and header files, not the loadable module. - This lack of a kernel module seems to contradict the Arch Wiki’s statement that “AppArmor is available in all officially supported kernels.” Given these findings, I have a few questions for the community: 1. Has anyone else experienced issues with AppArmor on the current EndeavourOS standard and LTS kernels? 2. Is the `apparmor` kernel module expected to be present in these kernels? If so, could someone point me to its location? 3. Are there any specific steps or configurations unique to EndeavourOS that are required to enable AppArmor? 4. Are there alternative kernels within the EndeavourOS/Arch ecosystem where AppArmor is known to be working correctly? Any insights or suggestions would be greatly appreciated. It seems like there might be an issue with the inclusion or availability of the AppArmor kernel module in the current kernel packages. Thank you for your time and assistance. ---
**Author:** ![cactux](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/cactux/32/134907_2.png) [@cactux](https://forum.endeavouros.com/u/cactux)\ **Post date:** [May 3, 2025, 9:31pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/2 "2025-05-03T21:31:30Z")
I have followed the instruction in Archwiki: [https://wiki.archlinux.org/title/AppArmor](https://wiki.archlinux.org/title/AppArmor) ```auto $ systemctl status apparmor.service ● apparmor.service - Load AppArmor profiles Loaded: loaded (/usr/lib/systemd/system/apparmor.service; enabled; preset: disabled) Active: active (exited) since Sat 2025-05-03 22:45:43 CEST; 38min ago Invocation: ac4f163ac3d34f448d449 Docs: man:apparmor(7) https://gitlab.com/apparmor/apparmor/wikis/home/ Process: 415 ExecStart=/lib/apparmor/apparmor.systemd reload (code=exited, status=0/SUCCESS) Main PID: 415 (code=exited, status=0/SUCCESS) Mem peak: 216.7M CPU: 13.689s ``` I don’t see any mention of` securityfs` in that page. What guide/tutorial have you been using? ---
**Author:** ![manyroads](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/manyroads/32/5885_2.png) [@manyroads](https://forum.endeavouros.com/u/manyroads)\ **Post date:** [May 3, 2025, 9:40pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/3 "2025-05-03T21:40:45Z")
I used the same page plus several hours of Gemini AI help to debug my install. The summary of which I posted in this OP You can Open a terminal and run: Bash sudo aa-status If you see profiles listed in enforce mode and processes associated with them, that’s a good sign AppArmor is actively working. Test with a confined application (if you know one): If you know of an application on your system that has an AppArmor profile (you might see its name listed in aa-status), you could try to perform an action with that application that you suspect might be restricted by its profile. Then, check dmesg again to see if there’s an “apparmor=” entry with “operation=…” and “denied=1”. For example, if a web browser is confined, you might try to access a system file outside of its allowed directories and see if AppArmor logs a denial. Be careful when doing this, as you might trigger unexpected behavior in the application. Check the AppArmor profile for a specific application: You can examine the AppArmor profile for an application (usually located in /etc/apparmor.d/) to understand what restrictions are in place. While this doesn’t tell you if it’s actively working, it gives you context on what it should be doing. ---
**Author:** ![cactux](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/cactux/32/134907_2.png) [@cactux](https://forum.endeavouros.com/u/cactux)\ **Post date:** [May 3, 2025, 9:45pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/4 "2025-05-03T21:45:01Z")
Well, that is strange then that it is not working for you. I have not needed to add anything to /etc/fstab and yet: ```auto $ mount | grep securityfs securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime) ``` ---
**Author:** ![cactux](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/cactux/32/134907_2.png) [@cactux](https://forum.endeavouros.com/u/cactux)\ **Post date:** [May 3, 2025, 9:53pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/5 "2025-05-03T21:53:14Z")
Can you post: `cat /proc/cmdline` ? Also: ```auto zgrep -i apparmor /proc/config.gz zgrep -i securityfs /proc/config.gz ``` ---
**Author:** ![Cphusion](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@Cphusion](https://forum.endeavouros.com/u/Cphusion)\ **Post date:** [May 3, 2025, 9:56pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/6 "2025-05-03T21:56:36Z")
> [@cactux](#): > > I have followed the instruction in Archwiki: [https://wiki.archlinux.org/title/AppArmor](https://wiki.archlinux.org/title/AppArmor) > > ```auto > > ``` Which profiles do you have activated as I have read that most apparmor profiles are written for Ubuntu-based distributions, so not sure that would benefit Arch Linux? ---
**Author:** ![cactux](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/cactux/32/134907_2.png) [@cactux](https://forum.endeavouros.com/u/cactux)\ **Post date:** [May 3, 2025, 10:00pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/7 "2025-05-03T22:00:51Z")
I have [https://aur.archlinux.org/packages/apparmor.d-git](https://aur.archlinux.org/packages/apparmor.d-git) ```auto # aa-status apparmor module is loaded. 1840 profiles are loaded. ``` Most of them are in complain mode though. ---
**Author:** ![Cphusion](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@Cphusion](https://forum.endeavouros.com/u/Cphusion)\ **Post date:** [May 3, 2025, 10:03pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/8 "2025-05-03T22:03:00Z")
> [@cactux](#): > > Most of them are in complain mode though. Why not switch them to enforce mode if they are profiles for Arch Linux? ---
**Author:** ![cactux](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/cactux/32/134907_2.png) [@cactux](https://forum.endeavouros.com/u/cactux)\ **Post date:** [May 3, 2025, 10:04pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/9 "2025-05-03T22:04:07Z")
> [@Cphusion](#): > > Why not switch them to enforce mode if they are profiles for Arch Linux? Yes. Good question! I haven’t tried. ---
**Author:** ![Cphusion](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@Cphusion](https://forum.endeavouros.com/u/Cphusion)\ **Post date:** [May 3, 2025, 10:05pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/10 "2025-05-03T22:05:46Z")
> [@cactux](#): > > Yes. Good question! I haven’t tried. Besides installing that PKGBUILD did you have to copy those profiles to a /etc/apparmor.d for them to be loaded, just asking as I might try it myself since I didn’t know about those Arch specific profiles before? ---
**Author:** ![cactux](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/cactux/32/134907_2.png) [@cactux](https://forum.endeavouros.com/u/cactux)\ **Post date:** [May 3, 2025, 10:06pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/11 "2025-05-03T22:06:44Z")
No. It installs them there when you install it from AUR. > [@Cphusion](#): > > I might try it myself since I didn’t know about those Arch specific profiles before? They may not be only specific to Arch though: > - Support all distributions that support AppArmor: > - [Arch Linux](https://apparmor.pujol.io/install#archlinux) > - [Ubuntu 24.04/22.04](https://apparmor.pujol.io/install#ubuntu) > - [Debian 12](https://apparmor.pujol.io/install#debian) > - [OpenSUSE Tumbleweed](https://apparmor.pujol.io/install#opensuse) > - Support for all major desktop environments: > - Gnome (GDM) > - KDE (SDDM) > - XFCE (Lightdm) _(work in progress)_ > **[GitHub - roddhjav/apparmor.d: Full set of AppArmor profiles (~ 1500 profiles)](https://github.com/roddhjav/apparmor.d)** > > Full set of AppArmor profiles (~ 1500 profiles) ---
**Author:** ![vazicebon](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/vazicebon/32/81098_2.png) [@vazicebon](https://forum.endeavouros.com/u/vazicebon)\ **Post date:** [May 3, 2025, 10:10pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/12 "2025-05-03T22:10:16Z")
Hello, I guess you can get some info from the system log : ```auto journalctl -b0 -r | grep apparmor ``` ---
**Author:** ![Cphusion](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@Cphusion](https://forum.endeavouros.com/u/Cphusion)\ **Post date:** [May 3, 2025, 11:13pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/13 "2025-05-03T23:13:43Z")
I tried it out but it looks like of everything that’s in enforcing mode is either not valid for Arch Linux or not installed and when you try to load everything into enforcing mode it finds conflicting profiles meaning you are going to have to sort out manually which profiles you want to enable. So not sure if it actually adds value on Arch Linux, at least not for me if I am going to have to manually select which profiles I want to put into enforcing mode because I am not going through 1800 profiles. ---
**Author:** ![cactux](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/cactux/32/134907_2.png) [@cactux](https://forum.endeavouros.com/u/cactux)\ **Post date:** [May 3, 2025, 11:17pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/14 "2025-05-03T23:17:13Z")
> [@Cphusion](#): > > you are going to have to sort out manually which profiles you want to enable I think also that this is the way it needs to be handled. On a per case basis. Certainly a tedious work. ---
**Author:** ![manyroads](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/manyroads/32/5885_2.png) [@manyroads](https://forum.endeavouros.com/u/manyroads)\ **Post date:** [May 6, 2025, 1:45pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/15 "2025-05-06T13:45:01Z")
After a bit of hunting around I suspect a more generalized solution might be to use the arch hardened kernel on EOS… I’ll test and see what I unearth. Either way I think the 90+% solution works; a few complains and even the odd warnings aren’t fatal to anything, so far as I have noticed. I’ll get around to writing up a tutorial on what seems to work for me (for any who are interested). As for tedious… yep. Is it worth it? I think so… but I’m not allowed to explain why, on these forums. 😇 ---
**Author:** ![Cphusion](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@Cphusion](https://forum.endeavouros.com/u/Cphusion)\ **Post date:** [May 6, 2025, 2:11pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/16 "2025-05-06T14:11:02Z")
> [@manyroads](#): > > As for tedious… yep. Is it worth it? I think so… but I’m not allowed to explain why, on these forums. 😇 I don’t have a problem with anyone explaining something. I didn’t find Apparmor useful if I have to select one by one which Apparmor profile I want on enforcing, especially if there are two profiles for different things in the same directory. From the ones I saw even the one from that git repo most things don’t apply to Arch or you need something specifically installed from a different profiles which is from the ones I checked not the case on my system. Then getting back to I don’t really want to have to manually select the ones I do want activated would rather just activate them all and let it do it’s work if the command or application is available on the system that is mentioned in a profile. I do prefer selinux and have tried getting it to work but found that’s even more manual work to setup on Arch so just left it for now. ---
**Author:** ![EOS](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/eos/32/121414_2.png) [@EOS](https://forum.endeavouros.com/u/EOS)\ **Post date:** [May 6, 2025, 4:25pm UTC](https://forum.endeavouros.com/t/apparmor-issues-on-endeavouros-standard-and-lts-kernels-seeking-community-input/70963/17 "2025-05-06T16:25:14Z")
> [@manyroads](#): > > Any insights or suggestions would be greatly appreciated. I think you have put the kernel settings wrong or in the wrong place. What does this command show you? ```auto cat /sys/kernel/security/lsm ``` If it does not contain: ```auto capability,landlock,lockdown,yama,apparmor,bpf ``` something must be wrong. [How to modify kernel options (systemd-boot)](https://discovery.endeavouros.com/installation/systemd-boot/2022/12/) It should be this easy to install: ```auto Install apparmor systemctl enable apparmor.service Edit /boot/loader/entries/linux-lts.conf **This is an example, do not copy directly** options root=PARTUUID=b409e006 lsm=landlock,lockdown,yama,integrity,apparmor,bpf zswap.enabled=0 rw rootfstype=ext4 reboot aa-enabled # aa-status # apparmor_parser /usr/share/apparmor/extra-profiles/ ```