for a straight list of loaded profiles names, you can do
$ sudo cat /sys/kernel/security/apparmor/profiles
/snap/core/6964/usr/lib/snapd/snap-confine (enforce)
/snap/core/6964/usr/lib/snapd/snap-confine//mount-namespace-capture-helper (enforce)
firefox (enforce)
firefox//sanitized_helper (enforce)
firefox//lsb_release (enforce)
...
we can then get a list of profile names from apparmor_parser without doing a compile using
$ sudo apparmor_parser -N /etc/apparmor.d/ /var/lib/snapd/apparmor/profiles/
udm-extractor
ubuntu-printing-app
/usr/sbin/tcpdump
...
so a quick and dirty script to get the diff
$ sudo cat /sys/kernel/security/apparmor/profiles | awk '{ print $1 }' > /tmp/foo ; sudo apparmor_parser -N /etc/apparmor.d/ /var/lib/snapd/apparmor/profiles/ >> /tmp/foo ; sort /tmp/foo | uniq -c | grep -e ' 1 '
basically anything with that doesn't show up in both gets a count of 1.
We can further distinguish profiles that have been loaded based on time if we need to with
$ ls -l /sys/kernel/security/apparmor/policy/profiles/
total 0
drwxr-xr-x 2 root root 0 May 21 23:16 content-hub-clipboard.1
drwxr-xr-x 2 root root 0 May 21 23:16 content-hub-peer-picker.2
drwxr-xr-x 2 root root 0 May 21 23:16 default.0
drwxr-xr-x 2 root root 0 May 21 23:16 etc.apparmor.d.skype.6
...
and we can try to load any of the profiles we find that failed to load individually with
$ apparmor_parser -r $profile
or if need be one by one via shell scripting (sadly the parser is missing a direct way to dump which profile is being worked on when it is processing multiple dirs) and it can't do it when killed from the oom killer either.
with this we should be able to track down which profile is failing
We can get a diff of loaded vs. expected profiles
for a straight list of loaded profiles names, you can do security/ apparmor/ profiles core/6964/ usr/lib/ snapd/snap- confine (enforce) core/6964/ usr/lib/ snapd/snap- confine/ /mount- namespace- capture- helper (enforce) /sanitized_ helper (enforce) /lsb_release (enforce)
$ sudo cat /sys/kernel/
/snap/
/snap/
firefox (enforce)
firefox/
firefox/
...
we can then get a list of profile names from apparmor_parser without doing a compile using snapd/apparmor/ profiles/ printing- app
$ sudo apparmor_parser -N /etc/apparmor.d/ /var/lib/
udm-extractor
ubuntu-
/usr/sbin/tcpdump
...
so a quick and dirty script to get the diff security/ apparmor/ profiles | awk '{ print $1 }' > /tmp/foo ; sudo apparmor_parser -N /etc/apparmor.d/ /var/lib/ snapd/apparmor/ profiles/ >> /tmp/foo ; sort /tmp/foo | uniq -c | grep -e ' 1 '
$ sudo cat /sys/kernel/
Skipping profile in /etc/apparmor. d/disable: usr.lib. libreoffice. program. oosplash d/usr.bin. firefox 79eb4c35- 23a7-44bb- 8894-aa97ca6168 50
Ignoring: 'usr.bin.firefox~'
1 /etc/apparmor.
1 libvirt-
...
basically anything with that doesn't show up in both gets a count of 1.
We can further distinguish profiles that have been loaded based on time if we need to with security/ apparmor/ policy/ profiles/ hub-clipboard. 1 hub-peer- picker. 2 d.skype. 6
$ ls -l /sys/kernel/
total 0
drwxr-xr-x 2 root root 0 May 21 23:16 content-
drwxr-xr-x 2 root root 0 May 21 23:16 content-
drwxr-xr-x 2 root root 0 May 21 23:16 default.0
drwxr-xr-x 2 root root 0 May 21 23:16 etc.apparmor.
...
and we can try to load any of the profiles we find that failed to load individually with
$ apparmor_parser -r $profile
or if need be one by one via shell scripting (sadly the parser is missing a direct way to dump which profile is being worked on when it is processing multiple dirs) and it can't do it when killed from the oom killer either.
with this we should be able to track down which profile is failing