Ensure all AppArmor Profiles are in enforce or complain mode

Cómo se verifica

Método de auditoría: Comando de shell

out=$(apparmor_status 2>/dev/null) || exit 1
l=$(printf '%s\n' "$out" | awk '/profiles are loaded/{print $1; exit}')
u=$(printf '%s\n' "$out" | awk '/processes are unconfined/{print $1; exit}')
[ "${l:-0}" -gt 0 ] || { echo 'no AppArmor profiles loaded'; exit 1; }
[ "${u:-0}" -eq 0 ] && echo compliant || echo "$u processes are unconfined"

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Run the following command to set all profiles to enforce mode: # aa-enforce /etc/apparmor.d/* OR Run the following command to set all profiles to complain mode: # aa-complain /etc/apparmor.d/* Any unconfined processes may need to have a profile created or activated for them and then be restarted.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target ros