Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to use AppArmor on a remote hosted Xen server with a custom built kernel.

AppArmor appears to be running, but not correctly. For example if I run the following command as root:

# aa-status
apparmor module is loaded.
You do not have enough privilege to read the profile set.

Any ideas what's going on would be helpful. Thank you!

Here's my kernel options:

# grep -i APPARMOR /boot/config-3.6.11-xen 

dmesg showing AppArmor started:

# dmesg | grep AppArmor
AppArmor: AppArmor initialized
AppArmor: AppArmor Filesystem Enabled

AppArmor hooks in /sys and their corresponding values:

(Note: no /sys/kernel/security/apparmor/profiles)

# for x in $(find /sys -type f | grep apparmor) ; do echo -n "$x - "; cat $x ; done
/sys/kernel/security/apparmor/features/rlimit/mask - cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime
/sys/kernel/security/apparmor/features/capability - 0xffffff
/sys/kernel/security/apparmor/features/file/mask - create read write exec append mmap_exec link lock
/sys/kernel/security/apparmor/features/domain/change_profile - yes
/sys/kernel/security/apparmor/features/domain/change_onexec - yes
/sys/kernel/security/apparmor/features/domain/change_hatv - yes
/sys/kernel/security/apparmor/features/domain/change_hat - yes
/sys/kernel/security/apparmor/.remove - cat: /sys/kernel/security/apparmor/.remove: Invalid argument
/sys/kernel/security/apparmor/.replace - cat: /sys/kernel/security/apparmor/.replace: Invalid argument
/sys/kernel/security/apparmor/.load - cat: /sys/kernel/security/apparmor/.load: Invalid argument
/sys/module/apparmor/parameters/mode - enforce
/sys/module/apparmor/parameters/audit - normal
/sys/module/apparmor/parameters/debug - N
/sys/module/apparmor/parameters/paranoid_load - Y
/sys/module/apparmor/parameters/enabled - Y
/sys/module/apparmor/parameters/path_max - 8192
/sys/module/apparmor/parameters/logsyscall - N
/sys/module/apparmor/parameters/lock_policy - N
/sys/module/apparmor/parameters/audit_header - Y

The user-land packages I have installed:

# dpkg -l apparmor*
Version                                         Description
ii  apparmor                                        2.7.102-0ubuntu3.7                              User-space parser utility for AppArmor
ii  apparmor-notify                                 2.7.102-0ubuntu3.7                              AppArmor notification system
ii  apparmor-profiles                               2.7.102-0ubuntu3.7                              Profiles for AppArmor Security policies
ii  apparmor-utils                                  2.7.102-0ubuntu3.7                              Utilities for controlling AppArmor

Again, if anyone has any idea why it's not operating correctly, including user-error, let me know. As far as I can see it looks like it should be working.

Thanks again for any guidance.

share|improve this question

I had the same problem ;)

  • Just download a apparmor package from:

  • navigate to: /apparmor-2.7.2/kernel-patches/3.1 < Here you have a patches for the kernel. Don't worry - they are working with 3.2.x version ;)

  • patch the kernel, select the option "Enable AppArmor 2.4 compatability" (eg. from make nconfig/make menuconfig).

  • Compile and be happy with fully working apparmor

Hope it helps!

PS. Sorry for my lame english - It's not my primary language :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.