I'm using AppArmor in complain mode for a process in our production environment and I see some false positive profile violations in my logs. I'd like to roll out an updated profile but I cannot restart the process.

Is there any way to replace an AppArmor profile without restarting the confined process? How to make sure that the profile has been correctly replaced?


From the Ubuntu Community Wiki:

AppArmor can only track and protect processes that are started after the kernel module has been loaded. After the apparmor packages have been installed, apparmor will be started. But running processes won't be protected by AppArmor. Either restarting the processes or rebooting will fix this.

If you are seeing false positives from the current profile, schedule the profile update for next maintenance period, or whenever you can soonest restart the application or reboot.

  • But in my situation the kernel module is loaded, and the old profile is assigned. I noticed that running aa-complain sometimes replaces the profile for a running process, but sometimes it fails and I'm looking for a more reliable way. – CaptainRR Nov 18 '18 at 9:45
  • @CaptainRR Unfortunately, there is currently no way to replace a profile without restarting the application. Note that, on a production server, you should never disable AppArmor or set it to complain for even the briefest period. Always do that on a dev system when testing things before it hits prod. – forest Nov 18 '18 at 9:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.