Ensure all AppArmor Profiles are enforcing

alt0() { command -v apparmor_status >/dev/null 2>&1 || { echo "step1: apparmor_status not installed"; return 1; }; o=$(bash -c apparmor_status 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'apparmor module is loaded.' || { echo step1: missing 'apparmor module is loaded.'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '17 profiles are loaded.' || { echo step1: missing '17 profiles are loaded.'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '17 profiles are in enforce mode.' || { echo step1: missing '17 profiles are in enforce mode.'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /bin/ping || { echo step1: missing /bin/ping; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /sbin/klogd || { echo step1: missing /sbin/klogd; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /sbin/syslog-ng || { echo step1: missing /sbin/syslog-ng; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /sbin/syslogd || { echo step1: missing /sbin/syslogd; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /usr/lib/PolicyKit/polkit-explicit-grant-helper || { echo step1: missing /usr/lib/PolicyKit/polkit-explicit-grant-helper; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /usr/lib/PolicyKit/polkit-grant-helper || { echo step1: missing /usr/lib/PolicyKit/polkit-grant-helper; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /usr/lib/PolicyKit/polkit-grant-helper-pam || { echo step1: missing /usr/lib/PolicyKit/polkit-grant-helper-pam; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /usr/lib/PolicyKit/polkit-read-auth-helper || { echo step1: missing /usr/lib/PolicyKit/polkit-read-auth-helper; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /usr/lib/PolicyKit/polkit-resolve-exe-helper || { echo step1: missing /usr/lib/PolicyKit/polkit-resolve-exe-helper; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /usr/lib/PolicyKit/polkit-revoke-helper || { echo step1: missing /usr/lib/PolicyKit/polkit-revoke-helper; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /usr/lib/PolicyKit/polkitd || { echo step1: missing /usr/lib/PolicyKit/polkitd; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /usr/sbin/avahi-daemon || { echo step1: missing /usr/sbin/avahi-daemon; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /usr/sbin/identd || { echo step1: missing /usr/sbin/identd; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /usr/sbin/mdnsd || { echo step1: missing /usr/sbin/mdnsd; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /usr/sbin/nscd || { echo step1: missing /usr/sbin/nscd; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /usr/sbin/ntpd || { echo step1: missing /usr/sbin/ntpd; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- /usr/sbin/traceroute || { echo step1: missing /usr/sbin/traceroute; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '0 profiles are in complain mode.' || { echo step1: missing '0 profiles are in complain mode.'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '1 processes have profiles defined.' || { echo step1: missing '1 processes have profiles defined.'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '1 processes are in enforce mode :' || { echo step1: missing '1 processes are in enforce mode :'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '/usr/sbin/nscd (3979)' || { echo step1: missing '/usr/sbin/nscd (3979)'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '0 processes are in complain mode.' || { echo step1: missing '0 processes are in complain mode.'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '0 processes are unconfined but have a profile defined.' || { echo step1: missing '0 processes are unconfined but have a profile defined.'; return 1; }; }; if alt0; then echo compliant; fi

tmaegis scan --target linux --level 2