How it works...
Profiles for AppArmor are written and loaded into the kernel using the apparmor_parser program. Mostly, these will be profiles located in /etc/apparmor.d/; though if a program doesn't have a profile, AppArmor doesn't stop it from running.
When the actual systemd unit is started, an init.d script is run (located at /etc/init.d/apparmor), which does the actual calling of apparmor_parser.
When profiles are run in enforcement mode, as the preceding fifteen are, they must adhere to the policy definition, or they will not be able to act outside the policy's requirements, and violations are logged. If profiles are in complain mode, the policy is not enforced, but violations are logged for later perusal.
Profiles are generally named ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access