2

I have been trying to load apparmor profile for a service that runs in systemd's user instance. I have two service files sample.service, for the process and another sample-profile-loader.service which loads its app armor profile usr.bin.Sample. The apparmor profile is placed in /lib/systemd/system and the process's service file is placed in /usr/lib/systemd/user. Both services are enabled.

[Unit] # sample-profile-loader.service
Before=sample.service
[Service]
Type=oneshot
ExecStart=/use/bin/apparmor-loader.sh 
/etc/apparmor.d/usr.bin.sample
[Install]
Wanted by=multi-user.target

[Unit] # sample.service
Requires=sample-profile-loader.service
After=sample-profile-loader.service
[Service]
Type=simple
ExecStart=/usr/bin/sample
[Install]
WantedBy=multi-user.target

After first boot, when I check aa-status the profile is loaded. But when I do a systemctl restart sample.service --user, I get an error message. "Failed to start sample.service. Unit sample-profile-loader.service failed to load. No such file or directory"

I have been going through Google for a solution to this. But haven't found one yet. It would be really good if you can give me any suggestion.

2 Answers 2

Reset to default
0

Systemd offers this variable for the unit files AppArmorProfile= , and set it to the profile you have. Im not sure about the directory.. try to find out how to add paths for apparmor to find the profiles..

1
  • Hi @Fisnik, thanks for the suggestion. In my case the apparmor profile path was /etc/apparmor.d and I loaded the profiles using the apparmor_parser script.
    – delver
    Dec 23, 2019 at 6:28
0

There is no need to differentiate between user and system service apparmor profiles. They can be together put in /etc/apparmor.d folder and loaded into the kernel using apparmor_parser.sh

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .