From e09e252bb2041a7a401c301decd377d7d527bded Mon Sep 17 00:00:00 2001 From: Duncan Overbruck Date: Sun, 2 Aug 2026 01:32:26 +0200 Subject: [PATCH] config/security/apparmor: remove /etc/default/apparmor --- src/config/security/apparmor.md | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/src/config/security/apparmor.md b/src/config/security/apparmor.md index 50f809f8f..884b45098 100644 --- a/src/config/security/apparmor.md +++ b/src/config/security/apparmor.md @@ -7,17 +7,12 @@ Void ships with some default profiles for several services, such as `dhcpcd` and `wpa_supplicant`. Container runtimes such as LXC and podman integrate with AppArmor for better security for container payloads. -To use AppArmor on a system, one must: +To use AppArmor install the `apparmor` package and add `apparmor=1 +security=apparmor` to the [kernel cmdline](./../kernel.md#cmdline). -1. Install the `apparmor` package. -2. Set `apparmor=1 security=apparmor` on the kernel commandline. - -To accomplish the second step, consult [the documentation on how to modify the -kernel cmdline](./../kernel.md#cmdline). - -The `APPARMOR` variable in `/etc/default/apparmor` controls how profiles will be -loaded at boot, the value is set to `complain` by default and corresponds to -AppArmor modes (`disable`, `complain`, `enforce`). +By default AppArmor will boot in `enforce` mode and disallow all policy +violations. To boot in `complain` mode, add `apparmor.mode=complain` to the +kernel cmdline. AppArmor tools [aa-genprof(8)](https://man.voidlinux.org/aa-genprof.8) and [aa-logprof(8)](https://man.voidlinux.org/aa-logprof.8) require either