Enable AppArmor or SELinux on Ubuntu 16.04 LTS

[Eddie_Paul_Litz]

On Ubuntu 16.04, how do I enable AppArmor or SELinux? It’s not in the Ubuntu App Store it won’t even work in Terminal. How do I enable one of them?

[veeg]

Hello Eddie

Hopefully some of our members will chime in soon..

jmarket @Twitch6000

[veeg]

Sorry for the no replies.

jmarket @Rustys @gus @Bruce

[Bruce]

Sorry, @vger, my Linux skills are that good.

[plodr]

I don’t run Ubuntu.

AppArmor is enabled by default.
Source: AppArmor - Ubuntu Wiki

AppArmor support was first introduced in Ubuntu 7.04, and is turned on by default in Ubuntu 7.10 and later.

Pages for 16.04
Ubuntu Manpage: AppArmor - kernel enhancement to confine programs to a limited set of resources.
Ubuntu Manpage: apparmor.d - syntax of security profiles for AppArmor.

[jmarket]

You can not use AppArmor and SELinux together. It’s one or the other.

AppArmor is enabled by default on kernels 2.6.36 and later. SELinux has to be manually installed.

If you wish to do so, you may follow the below instructions at your OWN RISK. I or anyone at PCHF assumes no responsibility for what may happen.

1. Stop the AppArmor script in /etc/init.d/

[ICODE]sudo /etc/init.d/apparmor stop[/ICODE]

1. Purge AppArmor from the system.

[ICODE] sudo apt purge apparmor[/ICODE]
If you want to keep AppArmor’s config files, use the below command instead:
[ICODE]sudo apt remove apparmor[/ICODE]

1. Update and reboot your system

sudo apt update && upgrade -yuf
sudo reboot

1. Install SELinux

sudo apt install selinux
sudo reboot

1. You can determine whether or not SELinux is enforcing security on your system by trying to set SELinux to enforcing mode.

pchf@ubuntu:~# sudo setenforce 1
pchf@ubuntu:~# sudo getenforce
Enforcing

1. To maintain enforcing mode after reboot, modify the SELinux configuration file in /etc/selinux/config from the default SELINUX=permissive to SELINUX=enforcing

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=enforcing

[veeg]

Any updates for us?

[Eddie_Paul_Litz]

None that I can think of.

[veeg]

So Eddie did you get what you needed from JM’s last post,if yes what was the result?

[Eddie_Paul_Litz]

It seemed like AppArmor was already running by default so I decided to leave it as it is when I installed Ubuntu.