AppArmor Plugin (apparmor)

AppArmor plugin, which allows changing "hat" (apparmor context) when user is loaded. Context is changed back to default on user deinit.

Multiple hats are supported and passed to aa_change_hatv() function.

Settings

apparmor_hats

Default	[None]
Value	Boolean List

List of AppArmor "hats" to change to when a user is loaded.

Example:

apparmor_hats {
  hat_name = yes
  another_hat = yes
}

Settings: Extra Fields

You can also specify hats from user or password database extra fields.

Password Database

If you provide from passdb, use userdb_apparmor_hats=hat.

User Database

If you provide from userdb, use apparmor_hats=hat.

Sample Configuration

mail_plugins {
  apparmor = yes
}

apparmor_hats = hat_name

Debugging

Enable log_debug to see context changes.