i can't disable apparmor in debian 10

Kernels & Hardware, configuring network, installing services

i can't disable apparmor in debian 10

Postby yohoho » 2020-03-14 14:34

This don't work:
Code: Select all
mkdir -p /etc/default/grub.d
echo 'GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT apparmor=0"' | tee /etc/default/grub.d/apparmor.cfg
update-grub
reboot

After reboot apparmor loaded again.
This don't work:
Code: Select all
systemctl stop apparmor
systemctl disable apparmor

aa-status
Code: Select all
apparmor module is loaded.

How to completely disable apparmor and unload rules?
yohoho
 
Posts: 7
Joined: 2019-12-22 05:26

Re: i can't disable apparmor in debian 10

Postby arzgi » 2020-03-14 15:11

Code: Select all
# apt purge apparmor
arzgi
 
Posts: 625
Joined: 2008-02-21 17:03
Location: Finland

Re: i can't disable apparmor in debian 10

Postby Head_on_a_Stick » 2020-03-14 16:33

yohoho wrote:This don't work:
Code: Select all
mkdir -p /etc/default/grub.d
echo 'GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT apparmor=0"' | tee /etc/default/grub.d/apparmor.cfg
update-grub
reboot

After reboot apparmor loaded again.

Did you check if the kernel parameter was actually applied?
Code: Select all
cat /proc/cmdline
User avatar
Head_on_a_Stick
 
Posts: 12004
Joined: 2014-06-01 17:46
Location: /dev/chair

Re: i can't disable apparmor in debian 10

Postby Deb-fan » 2020-03-15 08:22

At such times tend towards whipping out the big guns "sudo systemctl mask". Though helps to nose around a bit to see if there's affected dependency issues, often not. I like to nuke NetworkManager in this fashion. Someone can blacklist modules in /etc/modprobe.d files, so they don't load, should already be some examples there for cpu microcode, one per line etc. Have also seen the weirdness with kernel parameters not taking effect when added to /etc/default/grub as they should, tend to just keep poking at it, put it down to syntax or ordering error.

As Head_on mentions cat'ing /proc/cmdline to check. At times will do this via the grub screen, highlight the kernel line someone wishes to affect, press the "e" key for edit, add the params you're wanting to it and go from there, although don't believe it's meant to be persistent(only for that boot) and the grub file is where such things are supposed to be done. There's a second line in the grub file below the first, related to adding params, seems setting them there remain in effect vs using the first one. Really haven't sorted out how this works in detail. Just poke at it when needed, until output of "cat /proc/cmdline" shows me it's working as I'd wanted it. :)
Deb-fan
 
Posts: 708
Joined: 2012-08-14 12:27


Return to System configuration

Who is online

Users browsing this forum: No registered users and 6 guests

fashionable