Mandatory Access Control Issues
AppArmor (Application Armor) is a Linux kernel security module heavily utilized by Ubuntu. It acts as a mandatory access control system, restricting what files, directories, and capabilities a specific application is allowed to access, based on pre-defined security profiles. It is an excellent defense against zero-day exploits.
However, AppArmor can cause severe headaches if you try to deviate from standard Ubuntu file paths. For example, if you configure the MySQL daemon to store databases on a custom mounted external drive (e.g., /mnt/data/mysql) instead of the default /var/lib/mysql, AppArmor will immediately block the database from starting, resulting in confusing “Permission denied” errors, even if your file permissions (chown/chmod) are perfectly correct. If you are deeply customizing a server and don’t want to rewrite AppArmor profiles for every application, you can temporarily or permanently stop the service.
How to Stop and Disable the AppArmor Service
You can manage the security module using systemctl.
Warning: Disabling AppArmor significantly reduces the security posture of your Ubuntu system. Only do this on local, trusted networks, or if you are replacing it with a different security module like SELinux.
- Open your Ubuntu Terminal or connect via SSH.
- Stop the service, which will unload all currently enforced profiles from the kernel:
sudo systemctl stop apparmor.service- To ensure AppArmor does not load its profiles during the next boot, disable the service:
sudo systemctl disable apparmor.service- (Optional) To prevent other services from triggering it, mask the service:
sudo systemctl mask apparmor.serviceApplications will now have standard Linux DAC (Discretionary Access Control) permissions, allowing them to read and write to any directory their user account owns, regardless of non-standard file paths.