Contents
What is the purpose of AppArmor?
apparmor_parser is used to load a profile into the kernel. It can also be used to reload a currently loaded profile using the -r option after modifying it to have the changes take effect. The /etc/apparmor. d/disable directory can be used along with the apparmor_parser -R option to disable a profile.
What is AppArmor profile?
AppArmor is a Mandatory Access Control (MAC) system which confines programs to a limited set of resources. AppArmor confinement is provided via profiles loaded into the kernel. AppArmor can be set to either enforce the profile or complain when profile rules are violated.
How do I know if AppArmor is enabled?
AppArmor is activated in the kernel, but no policies are enforced. Detect the state of AppArmor by inspecting /sys/kernel/security/apparmor/profiles . If cat /sys/kernel/security/apparmor/profiles reports a list of profiles, AppArmor is running. If it is empty and returns nothing, AppArmor is stopped.
What happens if there is no Apparmor profile?
If the AppArmor profile does not exist, the pod will fail to be created. Each profile can be run in either enforce mode, which blocks access to disallowed resources, or complain mode, which only reports violations. After building an AppArmor profile, it is good practice to apply it with the complain mode first and let the workload run for a while.
What is the purpose of AppArmor in Linux?
AppArmor is a Linux kernel security module that supplements the standard Linux user and group-based permissions to confine programs to a limited set of resources. AppArmor can be configured for any application to reduce its potential attack surface and provide greater in-depth defense.
How to set default profile name in AppArmor?
The default profile name option specifies the profile to apply to containers by default when none is specified. The allowed profile names option specifies a list of profiles that Pod containers are allowed to be run with. If both options are provided, the default must be allowed. The profiles are specified in the same format as on containers.
How is AppArmor used to restrict access to resources?
Each profile can be run in either enforcing mode, which blocks access to disallowed resources, or complain mode, which only reports violations. AppArmor can help you to run a more secure deployment by restricting what containers are allowed to do, and/or provide better auditing through system logs.