Ensure AppArmor is installed
Ensures the apparmor package is installed so the kernel's Mandatory Access Control (MAC) framework is available to confine programs.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Without a Mandatory Access Control system installed, the host relies solely on Discretionary Access Control (Unix ownership and permissions), where any compromised process runs with the full rights of its user. AppArmor adds per-program confinement profiles that cap what a service may read, write or execute, so a breached daemon cannot reach beyond its declared resources. It is required by CIS 1.3.1.x and ANSSI BP-028 R45.
What Pavois checks
Pavois asks the package database (via dpkg) whether apparmor is installed using the InSpec package resource. Querying the effective package state is reliable across Debian and Ubuntu where AppArmor ships by default but can be removed or held back.
describe package('apparmor') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -s apparmor, expected Status: install ok installed. Confirm the framework is actually active with aa-status (lists enforced/complain profiles) or systemctl is-active apparmor.
Inspect & investigate
dpkg -l apparmorconfirms installation;aa-statusshows loaded profiles.- AppArmor denials are logged by the kernel:
journalctl -k | grep apparmorordmesg | grep -i apparmor, and on audit-enabled hosts in/var/log/audit/audit.log(type=AVC apparmor="DENIED").
Remediation
Pavois's harden plan installs the apparmor package (package resource, install action) with pavois harden apply. Installing the package makes the framework available; profiles still need to be loaded and set to enforce mode for confinement to take effect.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | apparmor |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing the package is non-disruptive. Risk appears when profiles move to enforce mode: an over-tight or buggy profile can block legitimate file access and break a service. Before enforcing, run profiles in complain mode (aa-complain), review audit.log denials, then enforce once clean. Keep a console/recovery path in case a profile confines sshd or a management agent.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R45 | direct | 2.0 | high |
| CIS | 1.3.1.1 | direct | per OS, see the benchmark table | high |
| DISA STIG | UBTU-22-431010, UBTU-24-100500 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.