1

I've installed Debian 12 Bookworm recently and, as far as I could read about a fresh installation, it comes with app-armor pre-installed by default. I'm running the command aa-status as root but it's returning: bash: aa-status: command not found. I know aa-status is part of apparmor-utils. And that's installed too.

Being more precise, the return of apt list --installed | grep apparmor here lies in:

apparmor-profiles/stable,stable,now 3.0.8-3 all [installed]
apparmor-utils/stable,stable,now 3.0.8-3 all [installed]
apparmor/stable,now 3.0.8-3 amd64 [installed]
libapparmor1/stable,now 3.0.8-3 amd64 [installed]
python3-apparmor/stable,stable,now 3.0.8-3 all [installed,automatic]
python3-libapparmor/stable,now 3.0.8-3 amd64 [installed,automatic]

Once I "ask" systemctl about apparmor with systemctl status apparmor it "says":

● apparmor.service - Load AppArmor profiles
     Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; preset: enabled)
     Active: active (exited) since Thu 2024-07-25 08:39:48 -03; 5min ago
       Docs: man:apparmor(7)
             https://gitlab.com/apparmor/apparmor/wikis/home/
    Process: 978 ExecStart=/lib/apparmor/apparmor.systemd reload (code=exited, status=0/SUCCESS)
   Main PID: 978 (code=exited, status=0/SUCCESS)
        CPU: 359ms

Jul 25 08:39:48 mypc systemd[1]: Starting apparmor.service - Load AppArmor profiles...
Jul 25 08:39:48 mypc apparmor.systemd[978]: Restarting AppArmor
Jul 25 08:39:48 mypc apparmor.systemd[978]: Reloading AppArmor profiles
Jul 25 08:39:48 mypc systemd[1]: Finished apparmor.service - Load AppArmor profiles.

I've also noticed the Finished apparmor.service - Load AppArmor profiles. but do not know what it mean. Do I need a profile to get it running properly? It does not come with default profiles? Could you help me to understand it better?

Thanks in advance!

Improve this question

1 Answer 1

Reset to default
1

aa-status is in /usr/sbin, which should be in root’s PATH — in your case it seems it isn’t. Try running

/usr/sbin/aa-status

explicitly.

AppArmor is handled by the kernel; the service unit you’ve found only loads the AppArmor profiles, it isn’t involved after that. Debian provides profiles for its packages, you shouldn’t need to configure anything to get them working. You can add your own profiles for your own purposes.

Improve this answer
2
  • Hey, thanks for the answer. It solved my problem. You answered so fast XD. Just explaining why: I need to have a custom profile to ensure an app will have access only to certain folders in my system. As soon as the site allows me I'll mark it as solved.
    – Neto Araujo
    Commented Jul 25 at 13:06
  • Right, that’s fine — I should really say you shouldn’t need to configure anything to get Debian packages working, you can definitely add your own profiles!
    – Stephen Kitt
    Commented Jul 25 at 13:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .