mediumaccess-controlverified ✓rollback-safe
Ensure AppArmor is active
apparmor-enabled · UBUNTU ≥ 22 · 1 impl
Description
The AppArmor service must be active so that its loaded mandatory access control profiles are enforced, confining programs to a limited set of resources.
Rationale
AppArmor provides mandatory access control that confines applications to the resources they legitimately need, limiting the damage a compromised process can cause. If the AppArmor service is not active, its profiles are not enforced and that confinement is absent.
Check → Remediate
Checkservice_state
- name:
- apparmor
- active:
- true
Remediateservice_enabled
- name:
- apparmor
Framework references
STIG
V-270660 / UBTU-24-100510V-260557 / UBTU-22-431015
NIST 800-53
AC-3AC-6SC-7
Live verification
ubuntu22:checkubuntu24:check
#apparmor#mac#mandatory-access-control