And hello, and welcome to our first lab,
a lab where we're going to get you up and running with AppArmor.
Don't forget that we're going to be working with our openSUSE 15.2.
We're working with three different systems on here because this is a
requirement for the certification of gaining Linux+ from CompTIA.
We're going to be looking at installing the AppArmor utilities,
installing the profiles,
and getting used to using the aa‑status command where we
can go through and would you believe it,
see the status of AppArmor.
And hello, and welcome through to our openSUSE system.
The system that you're going to start learning how to use AppArmor,
and put this as another tool within your tool belt.
We're using openSUSE.
But AppArmor is available on different systems,
but it's highly promoted by SUSE.
So let's go through and take a look.
The first thing I'm going to try and do is see the status of AppArmor.
Have I got any AppArmor utilities installed?
And I can begin that by typing aa and then just trying Tab
completion, so you know just hitting the double‑Tab key,
and it's not completing, so, of course,
then that I don't have AppArmor installed.
Now we're going to start installing it piece by piece to
try and get a picture of what's going on.
So using our package manager on openSUSE,
which is zypper, in for install,
‑y so it doesn't need to prompt me, and we can go through and
install AppArmor and then ‑utils for utilities.
Hit the big Enter key, allow that to cook through,
it's not going to take a lot of time, and then we should be up and running.
We can see it added in three packages for us.
And as I then go through and try my Tab completion,
look at this, glorious commands for me to play with.
We're not fully up and running yet, and we're going to start looking at this.
If I go through and take a look at aa‑status, now,
of course,
then you can probably guess by using the status command, we
are going to be looking at the status.
Now it's saying the module is loaded,
but we don't have any profiles that are loaded.
We don't have any profiles probably on our system full stop,
so the next step to do is to make sure that we have got our profiles.
And installing the profiles,
we're also going to add in a service that is going to
automatically load our profiles on system boot.
So as I go through and execute this, we can see then that they install.
Once they're installed, I can go back to my aa‑status and become perplexed.
I've just installed profiles, where are they?
But don't forget, installing the profiles was also adding in a service.
I can read that service with rcapparmor status,
but the reality is that this is just a link through to systemctl,
so I can manage it through here or through my systemctl command.
I'm going to briefly go through and run rcapparmor start.
And now if I go back and take a look at my status,
we should see then that it is active.
Now, remember this is a kernel‑based system,
so it's a kernel module that is loaded.
This service is to load my profiles.
We've just added my profiles, we've started my service,
and we can see now our profile should be loaded.
But as a reminder, though, this is just linking into systemctl,
so I can still manage it in the normal way.
And when we check the status,
the important thing that I can see here that it is active.
You only need to run once, so don't worry about the exited,
but we can see also that the service is enabled.
So on a system startup, our profiles are also going to load.
Now going back and taking a look at my aa‑status,
we can see now that I've got a lot of information.
Now I can scroll back up, and I can see that we've got 48 profiles.
Now profiles are one thing. Profiles are a set of predefined rules.
But just because I've got the profile doesn't mean that I've got the service,
so these are just predefined rules.
As I continue down to the bottom,
I can also see that there are no processes running at the
moment that are currently in enforce mode.
All of my profiles are in enforcing mode,
but currently, I don't have any processes,
which could be services or commands running that match any of these profiles. We're going to be changing that when we move back to our slides very shortly.