AppArmor Configuration

Understanding AppArmor with FC Storage

AppArmor does not directly govern FC transport, but it may restrict access to multipath device nodes and LVM operations depending on the active profiles.

Check AppArmor status:

sudo aa-status

AppArmor and Multipath

If AppArmor blocks multipath operations, check for denials:

sudo dmesg | grep -i apparmor | grep -i DENIED | tail -20
sudo journalctl -k | grep -i "apparmor.*DENIED" | tail -20

Add an exception if needed:

# Edit the profile or create a local override
sudo aa-complain /usr/sbin/multipathd
# Test and then re-enable enforce mode after verifying behavior
sudo aa-enforce /usr/sbin/multipathd

Best practice: In Ubuntu, the multipathd AppArmor profile ships with the multipath-tools package and is generally compatible with standard FC storage configurations. Only intervene if you observe active DENIED log entries.