diff --git a/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/rule.yml b/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/rule.yml index 29306db5546..2d3f9e2d873 100644 --- a/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/rule.yml +++ b/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/rule.yml @@ -34,4 +34,4 @@ references: cis@ubuntu2004: 1.7.1.4 cis@ubuntu2204: 1.6.1.4 -platform: package[apparmor] +platform: machine and package[apparmor] diff --git a/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/tests/correct_apparmor_profiles_enforced.pass.sh b/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/tests/correct_apparmor_profiles_enforced.pass.sh index e2651e31641..cba089f4309 100644 --- a/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/tests/correct_apparmor_profiles_enforced.pass.sh +++ b/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/tests/correct_apparmor_profiles_enforced.pass.sh @@ -1,4 +1,5 @@ #!/bin/bash +# packages = apparmor-utils #Replace apparmor definitions apparmor_parser -q -r /etc/apparmor.d/ diff --git a/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/tests/incorrect_apparmor_profiles.fail.sh b/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/tests/incorrect_apparmor_profiles.fail.sh index 9f23139ed3b..c9c33527421 100644 --- a/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/tests/incorrect_apparmor_profiles.fail.sh +++ b/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/tests/incorrect_apparmor_profiles.fail.sh @@ -1,4 +1,5 @@ #!/bin/bash +# packages = apparmor #Configure the OS to unload all AppArmor profiles aa-teardown diff --git a/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/tests/incorrect_apparmor_profiles_enforced.fail.sh b/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/tests/incorrect_apparmor_profiles_enforced.fail.sh index 565c2a7f12a..69423921bce 100644 --- a/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/tests/incorrect_apparmor_profiles_enforced.fail.sh +++ b/linux_os/guide/system/apparmor/all_apparmor_profiles_enforced/tests/incorrect_apparmor_profiles_enforced.fail.sh @@ -1,4 +1,5 @@ #!/bin/bash +# packages = apparmor #Replace apparmor definitions and force profiles into compliant mode apparmor_parser -C -q -r /etc/apparmor.d/ diff --git a/linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/bash/shared.sh b/linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/bash/shared.sh index 1abd7b39cfd..83ef5ebf2b5 100644 --- a/linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/bash/shared.sh +++ b/linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/bash/shared.sh @@ -19,8 +19,14 @@ fi if [ "$APPARMOR_MODE" = "complain" ] then + {{% if 'ubuntu' in product %}} + # Load all not-loaded profiles into complain mode + apparmor_parser -a --Complain /etc/apparmor.d/ + echo "***WARNING***: This remediation will not downgrade any existing AppArmor profiles." + {{% else %}} # Set all profiles to complain mode aa-complain /etc/apparmor.d/* + {{% endif %}} fi {{% if 'ubuntu' in product %}} diff --git a/linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/rule.yml b/linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/rule.yml index f494f563543..dd4a849d4de 100644 --- a/linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/rule.yml +++ b/linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/rule.yml @@ -37,4 +37,4 @@ references: cis@ubuntu2004: 1.7.1.3 cis@ubuntu2204: 1.6.1.3 -platform: package[apparmor] +platform: machine and package[apparmor] diff --git a/linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/tests/incorrect_all_apparmor_profiles.fail.sh b/linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/tests/incorrect_all_apparmor_profiles.fail.sh index 11227496723..c9c33527421 100644 --- a/linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/tests/incorrect_all_apparmor_profiles.fail.sh +++ b/linux_os/guide/system/apparmor/all_apparmor_profiles_in_enforce_complain_mode/tests/incorrect_all_apparmor_profiles.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# packages = apparmor-utils +# packages = apparmor #Configure the OS to unload all AppArmor profiles aa-teardown