Apparmor is not functioning

Question

When I check the status of Apparmor, I get this:

xubuntu@xubuntu:~$ sudo apparmor_status
apparmor module is loaded.
0 profiles are loaded.
0 profiles are in enforce mode.
0 profiles are in complain mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

What is wrong?

I have already downloaded/installed a profile, so that's not it.

I am running Xubuntu 14.04 on HP 2000-2b09WM Notebook PC, using a live-usb.

Could it be because I am using the live-usb?

Thank you.

RCline7

Answer 1

Apparmor that runs normally will show a number of loaded profiles. However, this is applicable only when Xubuntu has been installed to the local machine.

Could it be because I am using the live-usb?

So the short answer is, yes.

And it is not just Live USB, but also applies to Live CD/DVD regardless of the Xubuntu releases (I have confirmed myself using Xubuntu 12.04/14.04 on both live and local sessions).

The apparmor-profiles package isn't included on default installation of Xubuntu. Even so, running sudo apparmor_status by default will show more than 10 profiles loaded for evince, NetworkManager, lightdm, etc.

There are known exceptions, such as Apparmor is disabled by default for Firefox. Someone has asked this question on askubuntu already.

Finally, you may wonder why Apparmor profiles aren't loaded on live sessions?

Apparently, Apparmor doesn't work on stacked filesystem i.e. Live CD. And this has been reported as bug since Karmic and likely remain unfixed to this date.

Answer 2

I installed Xubuntu 14.04LTS on my HP 2000-2b09WM Notebook PC. Apparmor works on the installation, therefore, I know that the problem was the fact that I was running from a live-usb.

clearkimura was right-on, thank you.

RCline7