documentation_complete: true


title: 'Ensure AppArmor is Active and Configured'

description: |-
    Verify that the Apparmor tool is configured to
    control whitelisted applications and user home directory access
    control.<br/><br/>
    {{{ describe_service_enable(service="apparmor") }}}


rationale: |-
    Using a whitelist provides a configuration management method for allowing
    the execution of only authorized software. Using only authorized software
    decreases risk by limiting the number of potential vulnerabilities.<br/><br/>

    The organization must identify authorized software programs and permit
    execution of authorized software by adding each authorized program to the
    "pam_apparmor" exception policy. The process used to identify software
    programs that are authorized to execute on organizational information
    systems is commonly referred to as whitelisting.<br/><br/>

    Verification of whitelisted software occurs prior to execution or at system
    startup.<br/><br/>

    Users' home directories/folders may contain information of a sensitive
    nature. Nonprivileged users should coordinate any sharing of information
    with a System Administrator (SA) through shared resources.<br/><br/>

    Apparmor can confine users to their home directory, not allowing them to
    make any changes outside of their own home directories. Confining users to
    their home directory will minimize the risk of sharing information.

severity: medium

identifiers:
    cce@sle12: CCE-83194-1
    cce@sle15: CCE-85752-4

references:
    cis@sle12: 1.7.1.2
    cis@sle15: 1.7.1.2
    nist: AC-3(4),AC-6(8),AC-6(10),CM-7(5)(b),CM-7(2),SC-7(21),CM-6(a)
    srg: SRG-OS-000312-GPOS-00122,SRG-OS-000312-GPOS-00123,SRG-OS-000312-GPOS-00124,SRG-OS-000324-GPOS-00125,SRG-OS-000326-GPOS-00126,SRG-OS-000370-GPOS-00155,SRG-OS-000480-GPOS-00230,SRG-OS-000480-GPOS-00227,SRG-OS-000480-GPOS-00231,SRG-OS-000480-GPOS-00232
    stigid@sle12: SLES-12-010600
    stigid@sle15: SLES-15-010390

ocil_clause: 'it is not'

ocil: |-
    {{{ ocil_service_enabled(service="apparmor") }}}

template:
    name: service_enabled
    vars:
        servicename: apparmor
        packagename: apparmor-parser
        packagename@ubuntu2204: apparmor
        packagename@ubuntu2404: apparmor
        packagename@debian12: apparmor
