Ensure AppArmor is installed
An XCCDF Rule
Description
AppArmor provide Mandatory Access Controls.Rationale
Without a Mandatory Access Control system installed only the default Discretionary Access Control system will be available.
- ID
- xccdf_org.ssgproject.content_rule_package_apparmor_installed
- Severity
- Medium
- References
- Updated
Remediation Templates
A Puppet Snippet
include install_apparmor-profiles
class install_apparmor-profiles {
package { 'apparmor-profiles':
ensure => 'installed',
}
}
An Ansible Snippet
- name: Ensure apparmor-profiles is installed
package:
name: apparmor-profiles
state: present
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:OS Build Blueprint
[[packages]]
name = "apparmor-profiles"
version = "*"
A Shell Script
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
zypper install -y "apparmor-profiles"
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi