4

I'm using AppArmor in complain mode for a process in our production environment and I see some false positive profile violations in my logs. I'd like to roll out an updated profile but I cannot restart the process.

Is there any way to replace an AppArmor profile without restarting the confined process? How to make sure that the profile has been correctly replaced?

Improve this question
0

2 Answers 2

Reset to default
3

I found a function aa_replace_current_profile() that can replace current process profile. But I don't know how to replace the process you want.

Improve this answer
0

From the Ubuntu Community Wiki:

AppArmor can only track and protect processes that are started after the kernel module has been loaded. After the apparmor packages have been installed, apparmor will be started. But running processes won't be protected by AppArmor. Either restarting the processes or rebooting will fix this.

If you are seeing false positives from the current profile, schedule the profile update for next maintenance period, or whenever you can soonest restart the application or reboot.

Improve this answer
4
  • 1
    But in my situation the kernel module is loaded, and the old profile is assigned. I noticed that running aa-complain sometimes replaces the profile for a running process, but sometimes it fails and I'm looking for a more reliable way.
    – CaptainRR
    Commented Nov 18, 2018 at 9:45
  • @CaptainRR Unfortunately, there is currently no way to replace a profile without restarting the application. Note that, on a production server, you should never disable AppArmor or set it to complain for even the briefest period. Always do that on a dev system when testing things before it hits prod.
    – forest
    Commented Nov 18, 2018 at 9:46
  • @forest are you sure it is impossible? i think sucessfully did that in linux mint 19.3 with apparmor_parser -r -T -W /pathtoprofile but now i am in ubuntu 19.10 and that does not work.
    – qdinar
    Commented Apr 19, 2020 at 18:35
  • it works in ubuntu 19.10, it did not work because i wrote path in rule incorrectly.
    – qdinar
    Commented Apr 24, 2020 at 9:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .