CIS 1.7.1.2 on 20.04 AppArmor bootloader does not work on Azure

[Aaron Whitehouse]

It looks like there is an Azure-specific bug in the CIS hardening script for rule "Ensure AppArmor is enabled in the bootloader configuration" (CIS 1.7.1.2).

It looks like we append
GRUB_CMDLINE_LINUX="apparmor=1 security=apparmor"
to /etc/default/grub, but Azure has its own /etc/default/grub.d/50-cloudimg-settings.cfg where they define
GRUB_CMDLINE_LINUX="console=tty1 console=ttyS0 earlyprintk=ttyS0"
so we need to be appending the additional lines to that command instead (i.e. to make it GRUB_CMDLINE_LINUX="console=tty1 console=ttyS0 earlyprintk=ttyS0 apparmor=1 security=apparmor")

[Adam Bell (arbell)]

Hi Aaron (et al),

Is it possible that the /e/d/grub.d/50-cloudimg-settings.cfg GRUB_CMDLINE_LINUX line could be modified to include the previously defined GRUB_CMDLINE_LINUX variable? For example:
```
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX console=tty1 console=ttyS0 earlyprintk=ttyS0"
```

We do the same thing on the FIPS side with GRUB_CMDLINE_LINUX_DEFAULT to add "fips=1" to the command line.

Please let us know whether that could work on the Azure images or whether this would open a different issue on unhardened images.