Ensure AppArmor Utils is installed
Ensures the apparmor-utils package is installed, providing the tools (aa-status, aa-enforce, aa-complain, aa-genprof) needed to manage AppArmor profiles.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The base apparmor package enforces profiles but ships no management commands. Without apparmor-utils, administrators cannot inspect profile state, switch profiles between enforce and complain mode, or generate new profiles, making the MAC layer effectively unmaintainable. CIS requires the utilities so AppArmor can be operated and audited.
What Pavois checks
Pavois asks dpkg (via the InSpec package resource) whether apparmor-utils is installed. This reflects the effective package state rather than assuming the tools exist because the base framework is present.
describe package('apparmor-utils') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -s apparmor-utils, expected Status: install ok installed. Then aa-status should run and report the number of loaded profiles.
Inspect & investigate
dpkg -l apparmor-utilsconfirms installation;aa-statuslists enforced/complain profiles.- Profile changes made with these tools surface as kernel AppArmor events in
journalctl -k | grep apparmorand audit denials in/var/log/audit/audit.log.
Remediation
Pavois's harden plan installs the apparmor-utils package (package resource, install action) when you run pavois harden apply. It pulls in the management commands but does not change any profile's mode.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | apparmor-utils |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing the utilities is safe and non-disruptive, it only adds command-line tools. Risk only arises from how those tools are subsequently used (e.g. aa-enforce on an incomplete profile could block a service); test profile changes in complain mode first.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.3.1.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.