Install the pam_apparmor Package
Ensures the libpam-apparmor package (the pam_apparmor PAM module) is installed so sessions can be confined by AppArmor.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
libpam-apparmor provides the pam_apparmor module, which confines user sessions to an AppArmor profile at login. Enforcing mandatory access control on a per-session basis limits what a compromised account can reach. Protection of system integrity through this confinement depends on the package being installed; without it, the corresponding AppArmor session restrictions cannot be applied.
What Pavois checks
Pavois queries the package database via InSpec package('libpam-apparmor') (dpkg -s libpam-apparmor) and asserts it is installed. Checking the package state confirms the module is present and available to PAM; a missing package means no pam_apparmor line can take effect no matter what /etc/pam.d/ declares.
describe package('libpam-apparmor') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -s libpam-apparmor. The expected output includes Status: install ok installed. Anything else (e.g. is not installed) means the rule fails.
Inspect & investigate
Confirm installation via apt list --installed | grep libpam-apparmor or /var/log/apt/history.log. Once a profile confines a session, AppArmor decisions are logged to /var/log/syslog / journalctl -k as apparmor="DENIED"/"ALLOWED" audit lines (or /var/log/audit/audit.log when auditd is active).
Remediation
Pavois's harden plan declares a package resource named libpam-apparmor with action install; pavois harden apply runs the equivalent of apt-get install libpam-apparmor to reach the compliant state. Installing the package only makes the module available, you still configure pam_apparmor in PAM and define the AppArmor profiles separately.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | libpam-apparmor |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing the package alone is low-risk: it adds the module but changes no behavior until pam_apparmor is referenced in /etc/pam.d/ and a profile is defined. Precaution: the real risk comes later, an over-restrictive or missing session profile can prevent users from logging in or block needed actions. Roll out profiles in complain mode first (aa-complain), test login, then switch to enforce. Keep a root console open while testing to avoid lockout.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R45 | direct | 2.0 | high |
| NIST | AC-3(4), AC-6(8), AC-6(10), CM-7(5)(b), CM-7(2), SC-7(21), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.