iSCSI on SUSE/openSUSE - AppArmor Configuration

Understanding AppArmor on SUSE

AppArmor status:

• Available on SLES and openSUSE

• Not enabled by default on SLES (unlike Ubuntu)

• Can be enabled for additional security

Check AppArmor status:

sudo aa-status

# Check if AppArmor is enabled
sudo systemctl status apparmor

Enable AppArmor (Optional)

Enable AppArmor on SLES:

# Install AppArmor
sudo zypper install -y apparmor-utils apparmor-profiles

# Enable AppArmor
sudo systemctl enable --now apparmor

# Check status
sudo aa-status

AppArmor Profiles for iSCSI

Check iSCSI-related profiles:

# List loaded profiles
sudo aa-status | grep -i iscsi

# Check for denials
sudo dmesg | grep -i apparmor | grep -i iscsi

Most iSCSI tools run unconfined by default on SUSE

AppArmor Best Practices

1. Monitor for denials:

   sudo dmesg | grep -i apparmor 
   sudo journalctl | grep -i apparmor

2. Use complain mode for testing:

   # Set profile to complain mode 
   sudo aa-complain /usr/sbin/iscsid
   
   # Set back to enforce mode 
   sudo aa-enforce /usr/sbin/iscsid