You are not logged in.
Pages: 1
I'm trying to install apparmor on my system, I read the wiki and followed the steps exactly and when I check if it's enabled it says "No - disabled at boot."
The only thing I can think of that could be causing the problem is that I couldn't find apparmor-utils in the repos so I skipped that step.
I've been trying for a few days to figure this out, I've read the wiki, forums, external guides and I keep having the same problem.
Offline
apparmor-utils is not mentioned on https://wiki.archlinux.org/title/AppArmor and also not a package in repos or AUR .
Debian and ubuntu do have an apparmor-utils package but they tend to split things into multiple pacakges where archlinux just has one package.
Please post the output of aa-status .
Run (as root/with root rights))
# journalctl -b > journal_wrenb.txt
# curl --upload-file 'journal_wrenb.txt' 'https://paste.c-net.org/'The last command will output a link, post that link.
Welcome to archlinux forums
Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.
clean chroot building not flexible enough ?
Try clean chroot manager by graysky
Offline
sudo journalctl -b | curl -s -H "Accept: application/json, */*" --upload-file - 'https://paste.c-net.org/' 1 liner
Last edited by killertofus (2026-06-10 21:13:02)
I Have Linux Perl Can i Download Gnome???
Offline
apparmor-utils is not mentioned on https://wiki.archlinux.org/title/AppArmor and also not a package in repos or AUR .
Debian and ubuntu do have an apparmor-utils package but they tend to split things into multiple pacakges where archlinux just has one package.
Please post the output of aa-status .
Run (as root/with root rights))# journalctl -b > journal_wrenb.txt # curl --upload-file 'journal_wrenb.txt' 'https://paste.c-net.org/'The last command will output a link, post that link.
Welcome to archlinux forums
aa-status:
apparmor module is loaded.
apparmor filesystem is not mounted.jounalctl output: https://paste.c-net.org/DecodeAdieu
Offline
Jun 10 20:05:05 arch systemd[1]: Load AppArmor profiles skipped, unmet condition check ConditionSecurity=apparmorPlease post the output of
$ systemctl status apparmor.servicealso add the lsm kernel parameter to your boot command line , see https://wiki.archlinux.org/title/AppArmor#Installation .
Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.
clean chroot building not flexible enough ?
Try clean chroot manager by graysky
Offline
Jun 10 20:05:05 arch systemd[1]: Load AppArmor profiles skipped, unmet condition check ConditionSecurity=apparmorPlease post the output of
$ systemctl status apparmor.servicealso add the lsm kernel parameter to your boot command line , see https://wiki.archlinux.org/title/AppArmor#Installation .
I did add the lsm parameter. maybe I was doing it wrong though?
I edited /etc/default/grub and added the kernel parameters to GRUB_CMDLINE_LINUX_DEFAULT
I then ran
# grub-mkconfig -o /boot/grub/grub.cfgsysctl status:
○ apparmor.service - Load AppArmor profiles
Loaded: loaded (/us
r/lib/systemd/system/apparmor.service; enabled; preset:
disabled)
Active: inactive (dead)
Condition: start condition unmet at Thu 2026-06-11 13:25:24 M
DT; 52min ago
└─ ConditionSecurity=apparmor was not met
Docs: man:apparmor(7)
https://gitlab
.com/apparmor/apparmor/wikis/home/Last edited by wrenb (2026-06-11 20:25:04)
Offline
So still same error message.
Let's check the basics
$ cat /proc/cmdline
$ zgrep CONFIG_SECURITY_APPARMOR= /proc/config.gz
$ zgrep CONFIG_AUDIT= /proc/config.gz
$ zgrep CONFIG_LSM= /proc/config.gzAlso try running /lib/apparmor/apparmor.systemd reload from a root terminal* and copy the output.
* sudo rights may not be enough to run this, use su - if you want do this in a graphical terminal .
Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.
clean chroot building not flexible enough ?
Try clean chroot manager by graysky
Offline
So still same error message.
Let's check the basics
$ cat /proc/cmdline $ zgrep CONFIG_SECURITY_APPARMOR= /proc/config.gz $ zgrep CONFIG_AUDIT= /proc/config.gz $ zgrep CONFIG_LSM= /proc/config.gzAlso try running /lib/apparmor/apparmor.systemd reload from a root terminal* and copy the output.
I couldn't run /lib/apparmor/apparmor.systemd reload with sudo or su in both a graphical terminal and a tty
cmdline:
cryptdevice=UUID=f4fa744d-e2a2-49d2-8fd2-f50d0b138563:cryptlvm root=/dev/ArchinstallVg/root zswap.enabled=0 rootflags=subvol=@ rw rootfstype=btrfszgreps:
CONFIG_SECURITY_APPARMOR=y
CONFIG_AUDIT=y
CONFIG_LSM="landlock,lockdown,yama,integrity,bpf"that last one seems weird because in my grub config I have
lsm=landlock,lockdown,yama,integrity,apparmor,bpfOffline
The zgreps use information from the running kernel and are the same as on my system with linux kernel from repos.
The output of /proc/cmdline doesn't show the lsm= addition, so there may be something wrong with the usage of /etc/default/grub .
According to https://wiki.archlinux.org/title/Kernel_parameters#GRUB you can use e on the grub menu to manually change the commandline, try adding the lsm= stuff there.
Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.
clean chroot building not flexible enough ?
Try clean chroot manager by graysky
Offline
The zgreps use information from the running kernel and are the same as on my system with linux kernel from repos.
The output of /proc/cmdline doesn't show the lsm= addition, so there may be something wrong with the usage of /etc/default/grub .According to https://wiki.archlinux.org/title/Kernel_parameters#GRUB you can use e on the grub menu to manually change the commandline, try adding the lsm= stuff there.
OK, that worked and aa-enabled said yes. But it doesn't seem to have persistence across reboots, is there any way to fix that? I'd rather not have to add the parameter every single time
Last edited by wrenb (2026-06-14 04:09:02)
Offline
But it doesn't seem to have persistence across reboots, is there any way to fix that? I'd rather not have to add the parameter every single time
well, the wiki answers that, you have to edit /etc/default/grub and append your kernel options between the quotes in the GRUB_CMDLINE_LINUX_DEFAULT
and then automatically re generate the grub.cfg file by running
grub-mkconfig -o /boot/grub/grub.cfgas root
Edit:
after seeing #6 and #8, maybe there was a typo in the config? can you post the contents in that file for a sanity check?
cat /etc/default/grubLast edited by 5hridhyan (2026-06-14 04:30:43)
Fun fact: There is no such thing as bad luck. If there were, I'd call existence on Earth the ultimate example.
Offline
after seeing #6 and #8, maybe there was a typo in the config? can you post the contents in that file for a sanity check?
# GRUB boot loader configuration
GRUB_DEFAULT=0
GRUB_TIMEOUT=5
GRUB_DISTRIBUTOR="Arch"
GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 lsm=landlock,lockdown,yama,integrity,apparmor,bpf quiet splash apparmor=1 security=apparmor"
GRUB_CMDLINE_LINUX=""
# Preload both GPT and MBR modules so that they are not missed
GRUB_PRELOAD_MODULES="part_gpt part_msdos"
# Uncomment to enable booting from LUKS encrypted devices
#GRUB_ENABLE_CRYPTODISK=y
# Set to 'countdown' or 'hidden' to change timeout behavior,
# press ESC key to display menu.
GRUB_TIMEOUT_STYLE=menu
# Uncomment to use basic console
GRUB_TERMINAL_INPUT=console
# Uncomment to disable graphical terminal
#GRUB_TERMINAL_OUTPUT=console
# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command `videoinfo'
GRUB_GFXMODE=1920x1080
# Uncomment to allow the kernel use the same resolution used by grub
GRUB_GFXPAYLOAD_LINUX=keep
# Uncomment if you want GRUB to pass to the Linux kernel the old parameter
# format "root=/dev/xxx" instead of "root=/dev/disk/by-uuid/xxx"
#GRUB_DISABLE_LINUX_UUID=true
# Uncomment to disable generation of recovery mode menu entries
GRUB_DISABLE_RECOVERY=true
# Uncomment and set to the desired menu colors. Used by normal and wallpaper
# modes only. Entries specified as foreground/background.
#GRUB_COLOR_NORMAL="light-blue/black"
#GRUB_COLOR_HIGHLIGHT="light-cyan/blue"
# Uncomment one of them for the gfx desired, a image background or a gfxtheme
#GRUB_BACKGROUND="/path/to/wallpaper"
GRUB_THEME="/boot/grub/themes/catppuccin-mocha-grub-theme/theme.txt"
# Uncomment to get a beep at GRUB start
#GRUB_INIT_TUNE="480 440 1"
# Uncomment to make GRUB remember the last selection. This requires
# setting 'GRUB_DEFAULT=saved' above.
#GRUB_SAVEDEFAULT=true
# Uncomment to disable submenus in boot menu
#GRUB_DISABLE_SUBMENU=y
# Probing for other operating systems is disabled for security reasons. Read
# documentation on GRUB_DISABLE_OS_PROBER, if still want to enable this
# functionality install os-prober and uncomment to detect and include other
# operating systems.
#GRUB_DISABLE_OS_PROBER=falseOffline
Please post /boot/grub/grub.cfg as well as lsblk -f .
Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.
clean chroot building not flexible enough ?
Try clean chroot manager by graysky
Offline
Please post /boot/grub/grub.cfg as well as lsblk -f .
grub.cfg
#
# DO NOT EDIT THIS FILE
#
# It is automatically generated by grub-mkconfig using templates
# from /etc/grub.d and settings from /etc/default/grub
#
### BEGIN /etc/grub.d/00_header ###
insmod part_gpt
insmod part_msdos
if [ -s $prefix/grubenv ]; then
load_env
fi
if [ "${env_block}" ] ; then
set env_block="(${root})${env_block}"
export env_block
load_env -f "${env_block}"
fi
if [ "${next_entry}" ] ; then
set default="${next_entry}"
set next_entry=
if [ "${env_block}" ] ; then
save_env -f "${env_block}" next_entry
else
save_env next_entry
fi
set boot_once=true
else
set default="0"
fi
if [ x"${feature_menuentry_id}" = xy ]; then
menuentry_id_option="--id"
else
menuentry_id_option=""
fi
export menuentry_id_option
if [ "${prev_saved_entry}" ]; then
set saved_entry="${prev_saved_entry}"
save_env saved_entry
set prev_saved_entry=
save_env prev_saved_entry
set boot_once=true
fi
function savedefault {
if [ -z "${boot_once}" ]; then
saved_entry="${chosen}"
if [ "${env_block}" ] ; then
save_env -f "${env_block}" saved_entry
else
save_env saved_entry
fi
fi
}
function load_video {
if [ x$grub_platform = xefi ]; then
insmod efi_gop
insmod efi_uga
elif [ x$feature_all_video_module = xy ]; then
insmod all_video
else
insmod efi_gop
insmod efi_uga
insmod ieee1275_fb
insmod vbe
insmod vga
insmod video_bochs
insmod video_cirrus
fi
}
if loadfont unicode ; then
set gfxmode=1920x1080
load_video
insmod gfxterm
set locale_dir=$prefix/locale
set lang=en_US
insmod gettext
fi
terminal_input console
terminal_output gfxterm
insmod part_gpt
insmod fat
search --no-floppy --fs-uuid --set=root 9E9B-7299
insmod gfxmenu
loadfont ($root)/grub/themes/catppuccin-mocha-grub-theme/font.pf2
insmod png
set theme=($root)/grub/themes/catppuccin-mocha-grub-theme/theme.txt
export theme
if [ x$feature_timeout_style = xy ] ; then
set timeout_style=menu
set timeout=5
# Fallback normal timeout code in case the timeout_style feature is
# unavailable.
else
set timeout=5
fi
### END /etc/grub.d/00_header ###
### BEGIN /etc/grub.d/15_ostree ###
### END /etc/grub.d/15_ostree ###
### BEGIN /etc/grub.d/15_uki ###
if [ "$grub_platform" = "efi" ]; then
uki
fi
### END /etc/grub.d/15_uki ###
### BEGIN /etc/grub.d/20_linux_xen ###
### END /etc/grub.d/20_linux_xen ###
### BEGIN /etc/grub.d/25_bli ###
if [ "$grub_platform" = "efi" ]; then
insmod bli
fi
### END /etc/grub.d/25_bli ###
### BEGIN /etc/grub.d/30_os-prober ###
### END /etc/grub.d/30_os-prober ###
### BEGIN /etc/grub.d/30_uefi-firmware ###
if [ "$grub_platform" = "efi" ]; then
fwsetup --is-supported
if [ "$?" = 0 ]; then
menuentry 'UEFI Firmware Settings' $menuentry_id_option 'uefi-firmware' {
fwsetup
}
fi
fi
### END /etc/grub.d/30_uefi-firmware ###
### BEGIN /etc/grub.d/40_custom ###
# This file provides an easy way to add custom menu entries. Simply type the
# menu entries you want to add after this comment. Be careful not to change
# the 'exec tail' line above.
### END /etc/grub.d/40_custom ###
### BEGIN /etc/grub.d/41_custom ###
if [ -f ${config_directory}/custom.cfg ]; then
source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f $prefix/custom.cfg ]; then
source $prefix/custom.cfg
fi
### END /etc/grub.d/41_custom ###
### BEGIN /etc/grub.d/41_snapshots-btrfs ###
if [ ! -e "${prefix}/grub-btrfs.cfg" ]; then
echo ""
else
submenu 'Arch Linux snapshots' {
configfile "${prefix}/grub-btrfs.cfg"
}
fi
### END /etc/grub.d/41_snapshots-btrfs ###block devices:
NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS
zram0 swap 1 zram0 4561b8eb-ee1b-4fe0-8bae-0952551b7009 [SWAP]
nvme1n1
├─nvme1n1p1 vfat FAT32 9E9B-7299 963.5M 6% /boot
└─nvme1n1p2 crypto_LUKS 2 f4fa744d-e2a2-49d2-8fd2-f50d0b138563
└─cryptlvm LVM2_member LVM2 001 et2YAL-VisL-KSo6-Bbs4-MFLw-cmYa-p9OAvB
└─ArchinstallVg-root btrfs 5f7f9788-703e-4a67-a36f-51b315272ffe 746G 10% /var/log
/var/cache/pacman/pkg
/home
/
nvme0n1
└─nvme0n1p1 crypto_LUKS 2 d8266972-ec47-4dff-a826-8e957573e760
└─luks-d8266972-ec47-4dff-a826-8e957573e760 btrfs Secondary 277029cf-df46-4b34-a746-21917667661d 474.9G 0% /run/media/_0trustd/SecondaryOffline
That deosn't look like it was generated by grub-mkconfig
grub-mkconfig > /tmp/wtf.grub 2>&1and post /tmp/wtf.grub
Offline
That deosn't look like it was generated by grub-mkconfig
grub-mkconfig > /tmp/wtf.grub 2>&1and post /tmp/wtf.grub
output:
Generating grub configuration file ...
#
# DO NOT EDIT THIS FILE
#
# It is automatically generated by grub-mkconfig using templates
# from /etc/grub.d and settings from /etc/default/grub
#
### BEGIN /etc/grub.d/00_header ###
insmod part_gpt
insmod part_msdos
if [ -s $prefix/grubenv ]; then
load_env
fi
if [ "${env_block}" ] ; then
set env_block="(${root})${env_block}"
export env_block
load_env -f "${env_block}"
fi
if [ "${next_entry}" ] ; then
set default="${next_entry}"
set next_entry=
if [ "${env_block}" ] ; then
save_env -f "${env_block}" next_entry
else
save_env next_entry
fi
set boot_once=true
else
set default="0"
fi
if [ x"${feature_menuentry_id}" = xy ]; then
menuentry_id_option="--id"
else
menuentry_id_option=""
fi
export menuentry_id_option
if [ "${prev_saved_entry}" ]; then
set saved_entry="${prev_saved_entry}"
save_env saved_entry
set prev_saved_entry=
save_env prev_saved_entry
set boot_once=true
fi
function savedefault {
if [ -z "${boot_once}" ]; then
saved_entry="${chosen}"
if [ "${env_block}" ] ; then
save_env -f "${env_block}" saved_entry
else
save_env saved_entry
fi
fi
}
function load_video {
if [ x$grub_platform = xefi ]; then
insmod efi_gop
insmod efi_uga
elif [ x$feature_all_video_module = xy ]; then
insmod all_video
else
insmod efi_gop
insmod efi_uga
insmod ieee1275_fb
insmod vbe
insmod vga
insmod video_bochs
insmod video_cirrus
fi
}
if loadfont unicode ; then
set gfxmode=1920x1080
load_video
insmod gfxterm
set locale_dir=$prefix/locale
set lang=en_US
insmod gettext
fi
terminal_input console
terminal_output gfxterm
Found theme: /boot/grub/themes/catppuccin-mocha-grub-theme/theme.txt
insmod part_gpt
insmod fat
search --no-floppy --fs-uuid --set=root 9E9B-7299
insmod gfxmenu
loadfont ($root)/grub/themes/catppuccin-mocha-grub-theme/font.pf2
insmod png
set theme=($root)/grub/themes/catppuccin-mocha-grub-theme/theme.txt
export theme
if [ x$feature_timeout_style = xy ] ; then
set timeout_style=menu
set timeout=5
# Fallback normal timeout code in case the timeout_style feature is
# unavailable.
else
set timeout=5
fi
### END /etc/grub.d/00_header ###
### BEGIN /etc/grub.d/15_ostree ###
### END /etc/grub.d/15_ostree ###
### BEGIN /etc/grub.d/15_uki ###
if [ "$grub_platform" = "efi" ]; then
uki
fi
### END /etc/grub.d/15_uki ###
### BEGIN /etc/grub.d/20_linux_xen ###
### END /etc/grub.d/20_linux_xen ###
### BEGIN /etc/grub.d/25_bli ###
if [ "$grub_platform" = "efi" ]; then
insmod bli
fi
### END /etc/grub.d/25_bli ###
### BEGIN /etc/grub.d/30_os-prober ###
Warning: os-prober will not be executed to detect other bootable partitions.
Systems on them will not be added to the GRUB boot configuration.
Check GRUB_DISABLE_OS_PROBER documentation entry.
### END /etc/grub.d/30_os-prober ###
### BEGIN /etc/grub.d/30_uefi-firmware ###
Adding boot menu entry for UEFI Firmware Settings ...
if [ "$grub_platform" = "efi" ]; then
fwsetup --is-supported
if [ "$?" = 0 ]; then
menuentry 'UEFI Firmware Settings' $menuentry_id_option 'uefi-firmware' {
fwsetup
}
fi
fi
### END /etc/grub.d/30_uefi-firmware ###
### BEGIN /etc/grub.d/40_custom ###
# This file provides an easy way to add custom menu entries. Simply type the
# menu entries you want to add after this comment. Be careful not to change
# the 'exec tail' line above.
### END /etc/grub.d/40_custom ###
### BEGIN /etc/grub.d/41_custom ###
if [ -f ${config_directory}/custom.cfg ]; then
source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f $prefix/custom.cfg ]; then
source $prefix/custom.cfg
fi
### END /etc/grub.d/41_custom ###
### BEGIN /etc/grub.d/41_snapshots-btrfs ###
Detecting snapshots ...
Found snapshot: 2026-06-19 10:00:15 | @/.snapshots/209/snapshot | single | timeline |
Found snapshot: 2026-06-19 00:00:17 | @/.snapshots/208/snapshot | single | timeline |
Found snapshot: 2026-06-18 23:00:01 | @/.snapshots/207/snapshot | single | timeline |
Found snapshot: 2026-06-18 22:00:05 | @/.snapshots/206/snapshot | single | timeline |
Found snapshot: 2026-06-18 21:00:17 | @/.snapshots/205/snapshot | single | timeline |
Found snapshot: 2026-06-18 20:00:17 | @/.snapshots/204/snapshot | single | timeline |
Found snapshot: 2026-06-18 19:00:17 | @/.snapshots/203/snapshot | single | timeline |
Found snapshot: 2026-06-18 18:00:10 | @/.snapshots/202/snapshot | single | timeline |
Found snapshot: 2026-06-18 02:00:04 | @/.snapshots/201/snapshot | single | timeline |
Found snapshot: 2026-06-18 01:00:01 | @/.snapshots/200/snapshot | single | timeline |
Found snapshot: 2026-06-18 00:00:04 | @/.snapshots/199/snapshot | single | timeline |
Found snapshot: 2026-06-17 00:00:01 | @/.snapshots/187/snapshot | single | timeline |
Found snapshot: 2026-06-16 00:00:05 | @/.snapshots/173/snapshot | single | timeline |
Found snapshot: 2026-06-15 14:00:01 | @/.snapshots/166/snapshot | single | timeline |
Found snapshot: 2026-06-14 00:00:03 | @/.snapshots/159/snapshot | single | timeline |
Found snapshot: 2026-06-13 00:00:02 | @/.snapshots/145/snapshot | single | timeline |
Found snapshot: 2026-06-12 00:00:04 | @/.snapshots/133/snapshot | single | timeline |
Found snapshot: 2026-06-11 00:00:05 | @/.snapshots/121/snapshot | single | timeline |
Found snapshot: 2026-06-10 00:00:01 | @/.snapshots/106/snapshot | single | timeline |
Found snapshot: 2026-06-02 16:00:04 | @/.snapshots/1/snapshot | single | timeline |
if [ ! -e "${prefix}/grub-btrfs.cfg" ]; then
echo ""
else
submenu 'Arch Linux snapshots' {
configfile "${prefix}/grub-btrfs.cfg"
}
fi
Found 20 snapshot(s)
Unmount /tmp/grub-btrfs.rFae4mO4U0 .. Success
### END /etc/grub.d/41_snapshots-btrfs ###
doneOffline
ls -lr /bootOffline
-rwxr-xr-x 1 root root 18174464 Jun 17 15:56 vmlinuz-linux-zen
drwxr-xr-x 3 root root 4096 Jun 22 12:05 loader
drwxr-xr-x 6 root root 4096 Jun 22 00:11 grub
drwxr-xr-x 5 root root 4096 Jun 3 08:34 EFI
-rwxr-xr-x 1 root root 307200 May 19 18:22 amd-ucode.imgLast edited by wrenb (Yesterday 18:09:51)
Offline
Have you configured (and recreated) a https://wiki.archlinux.org/title/Unified_kernel_image ?
Offline
Pages: 1