[apparmor] /.load missing

[Lioh Moeller]

Hi again.

>> I am trying to run AppArmor on my system. I have compiled AppArmor support into the kernel but while trying to start the service I got an error message because /sys/kernel/security/.load is missing:
>>
>> https://termbin.com/8gsj
>>
> 
> /sys/kernel/security/.load is the wrong location
> 
> if securityfs is mounted at /sys/kernel/security then apparmor will create a directory within it and within the apparmor directory will be the .load file
> 
> ie. the location should be
> 
> /sys/kernel/security/apparmor/.load

Thanks for the clarification.

> you can tell if apparmor has successfully initialized by the following messages showing up in dmesg
> 
> AppArmor initialized

It does not show up on my machine,


> which will show up if the LSM module successfully registered, if not present ensure apparmor is configed in the kernel and that it is being used on boot (the config or security= or lsm= depending on your kernel version)
> 
> and
> 
> AppArmor Filesystem Enabled
> 
> which will show up if apparmor can successfully setup its filesystem interfaces

I have set

CONFIG_LSM="yama,loadpin,safesetid,integrity"

Do I have to add apparmor to the LSM list?

CONFIG_SECURITY_APPARMOR=y
CONFIG_SECURITY_APPARMOR_HASH=y
CONFIG_SECURITY_APPARMOR_HASH_DEFAULT=y

Currerntly CONFIG_DEFAULT_SECURITY_DAC is set. Should I switch that to:

CONFIG_DEFAULT_SECURITY_APPARMOR=y

Greetings

Lioh

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4003 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20191105/7dbac1e6/attachment-0001.bin>