How to enable apparmor?

[tushar]

I have enabled apparmor.service. I have followed the steps given in archwiki.

[archbtw]

Open /etc/default/grub with sudo permissions with nano or vim or vi or what ever is your favorite editor.

Open the terminal

$ export $EDITOR="your favorite editor" 
$ echo $EDITOR                 --> to check that the editor is properly set
$ sudoedit /etc/default/grub   --> it will prompt you for your password write it and hit enter

Now add in the line
GRUB_CMDLINE_LINUX_DEFAULT = " quiet apparmor=1 security=apparmor ..."

Save the file

$ sudo update-grub  --> it will prompt you for your password write it and hit enter

Restart your pc / laptop

Apparmor is not working

[jonathon]

@tushar

I have followed the steps given in archwiki.

If you followed the steps then it should be enabled and working…

@tushar

I have enabled apparmor.service

Did you also do the thing that immediately followed enabling the service?

To enable AppArmor as default security model on every boot, set the following kernel parameter:

lsm=landlock,lockdown,yama,apparmor,bpf

---

@archbtw

Now add in the line
GRUB_CMDLINE_LINUX_DEFAULT = " quiet apparmor=1 security=apparmor ..."

Interestingly, this doesn’t follow what the Arch wiki says - why is there a difference here?

@archbtw

sudo update-grub

I’m almost certain that EnOS doesn’t include this wrapper. Copy-pasting something from another forum isn’t great, and especially so when it’s based on a fundamentally different distribution and so ends up being misleading.

[tushar]

@jonathon

Did you also do the thing that immediately followed enabling the service?

I am getting an error. It says invalid argument.

[archbtw]

@jonathon

@archbtw

sudo update-grub

I’m almost certain that EnOS doesn’t include this wrapper. Copy-pasting something from another forum isn’t great, and especially so when it’s based on a fundamentally different distribution and so ends up being misleading.

sorry i thought it should work in eos as not only manjaro but other ubuntu derivatives also follow this command

[Kresimir]

On Buntu and Manjaro, update-grub either runs a script or is aliased to:

grub-mkconfig -o /boot/grub/grub.cfg

on Arch, btw, as well as on EndeavourOS, this alias does not exist.

Just copy-pasting a solution from another forum for another distro might be dangerous and you could cause more harm than good, if you do not understand what it does.

[freebird54]

Some of us have popped in an alias that does the same thing - but it is not a default by any means. Easily fixed by posting the alias beforehand, or the full command in posts…

[jonathon]

@tushar

I am getting an error. It says invalid argument.

What does? When? Where?

[tushar]

In terminal while adding apparmor to lsm=.

[jonathon]

That doesn’t make much sense - could you expand on exactly what you did?

[tushar]

[pebcak]

https://wiki.archlinux.org/title/Apparmor#Installation

For adding kernel parameters, choose the instructions for the bootloader you are using:

https://wiki.archlinux.org/title/Kernel_parameter

[Melways]

I did this on a machine recently and couldn’t get it to work following the arch wiki.

This is what worked for me:

1. sudo systemctl enable apparmor.service

2. sudo nano /etc/default/grub

3. find the line that starts with:

GRUB_CMDLINE_LINUX_DEFAULT =

add this:

apparmor=1 security=apparmor

4. Hold ctrl and O

Note: the letter O, not the number zero.

5. Hold ctrl and and press x

6. grub-mkconfig -o /boot/grub/grub.cfg

7. reboot

8. check if apparmor is running with:

systemctl status apparmor

or

aa-enabled

[pebcak]

(deleted by author)

[tushar]

Could you please elaborate the methods. I could not understand what to do? How to determine your bootloader?

[jonathon]

If you installed EnOS then you have GRUB.