I've compiled a kernel (linux-libre-xtreme) with this configuration, it has most LSMs enabled: YAMA, SMACK, AppArmor, TOMOYO and SELinux. However, when I start the apparmor service with OpenRC I get:

# rc-service apparmor start
 * Stopping AppArmor ...
 *   Unloading AppArmor profiles
 *   Root privileges not available                                                                                                                                [ !! ]
 * Starting AppArmor ...
 *   Loading AppArmor profiles ...
Cache read/write disabled: interface file missing. (Kernel needs AppArmor 2.4 compatibility patch.)
Warning: unable to find a suitable fs in /proc/mounts, is it mounted?
Use --subdomainfs to override.
 *   /etc/apparmor.d/usr.bin.apache2 failed to load
Cache read/write disabled: interface file missing. (Kernel needs AppArmor 2.4 compatibility patch.)
Warning: unable to find a suitable fs in /proc/mounts, is it mounted?
Use --subdomainfs to override.

And other profiles also complain, however this doesn't happen with other kernel that I've compiled too (linux-libre-lts-apparmor, see its configuration here)

What am I doing wrong? If I do cat /sys/module/apparmor/parameters/enabled with the linux-libre-xtreme kernel, I get N, but with linux-libre-lts-apparmor, it says Y, so I know it's not something with kernel parameters from the bootloader.

up vote 0 down vote accepted

Solved by disabling CONFIG_DEFAULT_SECURITY_DAC=y, there has to be only one CONFIG_DEFAULT_SECURITY_* enabled it seems

EDIT: I also discovered that, for AppArmor to be enabled by default when booting, SECURITY_APPARMOR_BOOTPARAM_VALUE must be set to "1", like this: CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.