Skip to content

Drop obsolete AppArmor setup from Arch Linux Template #527

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Antiz96 merged 1 commit into from
Apr 15, 2026
Merged

Drop obsolete AppArmor setup from Arch Linux Template #527

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 0 additions & 23 deletions VMs/Arch-Linux_Server_Template.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,29 +52,6 @@ vim /etc/systemd/network/enp1s0.network # Adapt the name of the file according t
> DNS=192.168.96.1
> IPv6AcceptRA=no

## Optional - Install and enable AppArmor

AppArmor is a kernel security module that restricts individual programs' capabilities.

Unlike Debian, Arch Linux does not install or enable AppArmor by default, and it does not maintain an extensive set of extra profiles.
Nevertheless, the default profiles provided with AppArmor cover a few programs I commonly use, and some applications I install on my servers (e.g. Docker) include their own profiles. Therefore, enabling AppArmor still provides *some* additional layer of security, which is why I usually install and enable it.

```bash
pacman -S apparmor # Install AppArmor
vim /boot/loader/entries/arch.conf # Add AppArmor to the lsm parameter of the kernel cmdline in systemd-boot config
```

> [...]
> options root=UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx rw **lsm=landlock,lockdown,yama,integrity,apparmor,bpf**
> [...]

```bash
systemctl enable apparmor.service # Start AppArmor service automatically on boot
reboot
aa-enabled # Verify that AppArmor is running
aa-status # Check the list of profile and their status
```

## Install useful packages

Replaces: <https://github.com/Antiz96/Linux-Desktop/blob/main/Arch-Linux/Base_installation.md#log-in-with-the-regular-user-previously-created-and-install-additional-useful-packages>
Expand Down