✎ 1.6.2.1 Ensure AppArmor is not disabled in bootloader configuration (Scored) [SecScan]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

====== 1.6.2.1 Ensure AppArmor is not disabled in bootloader configuration (Scored) ======
=====Profile Applicability=====  
<code>
Level 2 - Server 
Level 2 - Workstation
</code>
=====Description=====
Configure AppArmor to be enabled at boot time and verify that it has not been overwritten by the bootloader boot parameters.
=====Rationale=====
AppArmor must be enabled at boot time in your bootloader configuration to ensure that the controls it provides are not overridden.
=====Audit===== 
Run the following command and verify that no linux line the ''apparmor=0'' parameter set:
<Code:bash>
# grep "^\s*linux" /boot/grub/grub.cfg
</Code>
=====Remediation===== 
Edit ''/etc/default/grub'' and remove all instances of ''apparmor=0'' from all CMDLINE_LINUX parameters:
<Code:bash>
GRUB_CMDLINE_LINUX_DEFAULT="quiet" 
GRUB_CMDLINE_LINUX=""
</Code>
Run the following command to update the ''grub2'' configuration:
<Code:bash>
# update-grub
</Code>
=====Notes===== 
This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings.