Server security / Stage 8 of 10

AppArmor: when the profile denies access

Not running Starting usually ~20 s

Step 5 of 5 · summary · 3 min

Summary

The file permissions are right, yet there is no access — that is what an AppArmor denial looks like; its line is apparmor="DENIED" in the kernel log.
The denial line names the profile, the path and the action (r/w) — from it you see which path to add.
The enforce mode forbids everything extra, complain only logs; you switch with aa-enforce/aa-complain.
The needed path is added to /etc/apparmor.d/local/<profile> and reloaded with apparmor_parser -r, keeping the profile in enforce.
lab-docs from the start of the lesson refused because the data was moved to /srv/docs while the profile allowed only the former directory.

Ubuntu 24.04