2

I have been trying to load apparmor profile for a service that runs in systemd's user instance. I have two service files sample.service, for the process and another sample-profile-loader.service which loads its app armor profile usr.bin.Sample. The apparmor profile is placed in /lib/systemd/system and the process's service file is placed in /usr/lib/systemd/user. Both services are enabled.

[Unit] # sample-profile-loader.service
Before=sample.service
[Service]
Type=oneshot
ExecStart=/use/bin/apparmor-loader.sh 
/etc/apparmor.d/usr.bin.sample
[Install]
Wanted by=multi-user.target

[Unit] # sample.service
Requires=sample-profile-loader.service
After=sample-profile-loader.service
[Service]
Type=simple
ExecStart=/usr/bin/sample
[Install]
WantedBy=multi-user.target

After first boot, when I check aa-status the profile is loaded. But when I do a systemctl restart sample.service --user, I get an error message. "Failed to start sample.service. Unit sample-profile-loader.service failed to load. No such file or directory"

I have been going through Google for a solution to this. But haven't found one yet. It would be really good if you can give me any suggestion.

Improve this question

2 Answers 2

Reset to default
0

Systemd offers this variable for the unit files AppArmorProfile= , and set it to the profile you have. Im not sure about the directory.. try to find out how to add paths for apparmor to find the profiles..

Improve this answer
1
  • Hi @Fisnik, thanks for the suggestion. In my case the apparmor profile path was /etc/apparmor.d and I loaded the profiles using the apparmor_parser script.
    – delver
    Dec 23, 2019 at 6:28
0

There is no need to differentiate between user and system service apparmor profiles. They can be together put in /etc/apparmor.d folder and loaded into the kernel using apparmor_parser.sh

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .