How can I recompiel the apparmor module

Hello to all.
In case this is a thread in the wrong section please move it to the right one. Following situation applies.
I am using openSUSE 11.1 with modified kernel.

# uname -a
Linux linux-2c5j 3.0.4-41-desktop #1 SMP PREEMPT Sun Sep 4 18:51:01 CEST 2011 i686 i686 i386 GNU/Linux

The compilation did run flawlessly with the SAKC script. However the module apparmor does not load. Infact:

# modprobe apparmor
FATAL: Module apparmor not found.

I understand that I have to recompile the module, right? There I have the first question: wasn’t the apparmor module accepted into the kernel (and therefore should be already compiled and available with the normal kernel compile)? Or is this wrong.
How can I recompile the apparmor module for my new kernel.
Thanks for every suggestion.

BTW, kernel.org is still unreachable right?

On 2011-09-11 00:16, stakanov wrote:
> I understand that I have to recompile the module, right? There I have
> the first question: wasn’t the apparmor module accepted into the kernel
> (and therefore should be already compiled and available with the normal
> kernel compile)? Or is this wrong.

cer@Telcontar:~> zgrep -i armo /proc/config.gz
CONFIG_SECURITY_APPARMOR=y
CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
CONFIG_SECURITY_APPARMOR_COMPAT_24=y
CONFIG_DEFAULT_SECURITY_APPARMOR=y
CONFIG_DEFAULT_SECURITY=“apparmor”


Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)

Thank you so much for your feedback.
I did as you told me and now

zgrep -i armo /proc/config.gz
CONFIG_SECURITY_APPARMOR=y
CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
CONFIG_DEFAULT_SECURITY_APPARMOR=y
CONFIG_DEFAULT_SECURITY="apparmor"

But I still get the very same error message during boot.
So I am puzzled. Does it work or is apparmor still inactive. Because:

modprobe apparmor
FATAL: Module apparmor not found.

Thank you in advance.

On 2011-09-19 15:36, stakanov wrote:
>
> Thank you so much for your feedback.
> I did as you told me and now

You did? Changing those values (menuconfig) means recompiling the entire
kernel. Did you?

I only intended to show you how to discover if the running kernel has
support for apparmor.


Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)

I did not understand this, sorry. With people like me you have to be a bit more “verbose” I fear. :shame: Now, the kernel compilation I did it with the script SAKC when I changed from the previous one.
If I reuse this script (provided you are aware of it and have taken a look - a possibility that I hope to be the case) will it compile with these values? If I well understand with the command I did look in a compressed file using grep (zgrep) ignoring " case distinctions in both the PATTERN and the input files" - sentence of the manual that I do not really understand (the -i option). I am doing this in the file “/proc/config.gz” and searching for “armo” So then I did not change the values but they were already set? Then why do I get the error message?

P.S. have patience. This is like the “apprentie sorcier”. But I have to begin somewhere, so although I read man pages, not being in IT brings it with it that I do not have the knowledge to fully understand all implication. But as this knowledge is circular, there is no other way. Sorry for being slow, appear stupid or asking things that “people should know”. And yes about zgrep and grep I did RTFM. But that does not make me fully understand everything. :expressionless:

On 2011-09-19 16:36, stakanov wrote:
>
> I did not understand this, sorry. With people like me you have to be a
> bit more “verbose” I fear. :shame: Now, the kernel compilation I did it
> with the script SAKC when I changed from the previous one.
> If I reuse this script (provided you are aware of it and have taken a
> look - a possibility that I hope to be the case) will it compile with
> these values? If I well understand with the command I did look in a
> compressed file using grep (zgrep) ignoring " case distinctions in both
> the PATTERN and the input files" - sentence of the manual that I do not
> really understand (the -i option). I am doing this in the file
> “/proc/config.gz” and searching for “armo” So then I did not change the
> values but they were already set? Then why do I get the error message?

“/proc/config.gz” is a virtual file that shows the configuration of the
current, running, kernel. To modify the configuration of the kernel you
change instead “/usr/src/linux.config”, usually by running “make
menuconfig” on that directory, or equivalent option, and then recompile the
kernel. I heard of the SAKC script, but I’m not conversant with it

However: Apparmor is directly compiled into the kernel, is not a module;
thus you can not load it. That is the reason you get an error. If your
running kernel has those values in “/proc/config.gz”, then apparmor is
already “loaded”. Maybe you simply need to activate it, but I don’t know if
that is so, and how. Check the boot scripts of a normal openSUSE system to
see what they do :slight_smile:


Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)