AppArmor automatically enabled during upgrade

This document (000021001) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP3

Situation

If the AppArmor systemd service is disabled in SLES12-SP3, it is changed to "enabled" during the upgrade to SLES12-SP5, because of a change in the "vendor preset" value that occurred in SLES12-SP4.

SLES12 SP5 Example:

systemctl status apparmor.service 
● apparmor.service - Load AppArmor profiles
   Loaded: loaded (/usr/lib/systemd/system/apparmor.service; enabled; vendor preset: enabled)
   Active: active (exited) since Sun 2023-02-05 18:43:13 CST; 3 weeks 4 days ago
 Main PID: 398 (code=exited, status=0/SUCCESS)
    Tasks: 0 (limit: 512)
   CGroup: /system.slice/apparmor.service

Resolution

On 12-SP3 there are two alternatives to prevent this situation. You can set both if you really want to make sure AppArmor always stays disabled.

These can be applied to any SLES12 SP3/4/5 if you prefer AppArmor to always be disabled across the board.

1. Create a directory and preset file in /etc/systemd path.

mkdir /etc/systemd/system-preset/
echo "disable apparmor.service" > /etc/systemd/system-preset/80-apparmor.preset

This will override the system preset files and configuration that are in /usr/lib/systemd/system-preset/
for the AppArmor service only.

2. Set a systemd "mask" on the AppArmor service file, this will prevent AppArmor from running unless someone removes the mask.

systemctl mask apparmor.service

Then the service will be permanently disabled.

Example:

systemctl status apparmor.service 
● apparmor.service
   Loaded: masked (/dev/null; masked)
   Active: inactive (dead) since Fri 2023-03-03 16:28:16 CST; 2s ago
 Main PID: 398 (code=exited, status=0/SUCCESS)

Cause

Due to a change in the systemd vendor preset file, AppArmor is enabled during OS upgrade.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.