Learn how to disable AppArmor in LXC. Our LXC/LXD Support team is here to help you with your questions and concerns.

LXC Disable AppArmor | Guide

In the world of cybersecurity, proactive measures are key to protecting operating systems against external threats, internal vulnerabilities, and even zero-day attacks.
AppArmor is a security framework, that enforces rule sets on a per-application basis.

Today, we are going to take a closer look at AppArmor and how it shields the operating system and applications from potential risks.

In some cases, restarting AppArmor on openSUSE does not work as per expectations. This is why our experts recommend using `aa-disable` when AppArmor is running. This makes sure that the proper disablement and unloading of a running profile addresses any potential issues.

LXC Containers integrates seamlessly with AppArmor. This results in a default AppArmor profile that protects the host. The `usr.bin.lxc-start` profile plays a key role in preventing unwanted actions.

Furthermore, this profile is defined in `/etc/apparmor.d/lxc/lxc-default`. It also acts as a protective barrier during the initialization process.

Customizing AppArmor Profiles in LXC

LXC lets us customize AppArmor profiles for containers. The `lxc-container-default-with-nesting` profile enables container nesting, allowing the execution of containers within containers. This is done by adding `lxc.aa_profile = lxc-container-default-with-nesting` to the container configuration file.

If libvirt is inside the container, we have to make changes to the policy. It involves uncommenting the line `mount fstype=cgroup -> /sys/fs/cgroup/**` in the `/etc/apparmor.d/lxc/lxc-default-with-nesting` file.

This ensures compatibility with libvirt. It also opens the gates for more sophisticated container configurations.

Disabling AppArmor for Specific LXC Containers

In certain cases, we may have to disable AppArmor for specific LXC containers. The `lxc.apparmor.profile=unconfined` configuration, applied through commands like `lxc config set a1 raw.lxc “lxc.apparmor.profile=unconfined”`, grants unconfined access, balancing the need for security and operational flexibility.

Let us know in the comments if you need further help with disabling AppArmor.

[Need assistance with a different issue? Our team is available 24/7.]

Conclusion

Today, our Support Engineers demonstrated how to disable AppArmor.