add apparmor and audit

3 files changed, 13 insertions, 2 deletions

diff --git a/all b/all
index f89eca6..4f32a5c 100644
--- a/all
+++ b/all
@@ -1,4 +1,6 @@
 adriconf
+apparmor
+audit
 base-devel
 bash-completion
 bat
diff --git a/etc/kernel/cmdline b/etc/kernel/cmdline
index e226a97..0f92566 100644
--- a/etc/kernel/cmdline
+++ b/etc/kernel/cmdline
@@ -1 +1 @@
-root=PARTUUID=b7b36d6f-21ff-4f11-87a5-d07a84f4cc87 zswap.enabled=0 rootflags=subvol=@ rw rootfstype=btrfs init_on_alloc=1 init_on_free=1 slab_nomerge page_alloc.shuffle=1 vsyscall=none quiet splash
+root=PARTUUID=b7b36d6f-21ff-4f11-87a5-d07a84f4cc87 zswap.enabled=0 rootflags=subvol=@ rw rootfstype=btrfs init_on_alloc=1 init_on_free=1 slab_nomerge page_alloc.shuffle=1 vsyscall=none apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf audit=1 audit_backlog_limit=8192 quiet splash
diff --git a/setup.sh b/setup.sh
index db22db7..b07758f 100755
--- a/setup.sh
+++ b/setup.sh
@@ -151,13 +151,15 @@ systemctl --user enable ssh-agent.socket
 # Enable System-Level Services
 log_info "Enabling system-level services and timers..."
 SYSTEM_SERVICES=(
+    "apparmor.service"
+    "auditd.service"
     "reflector.timer"
     "paccache.timer"
     "keyd.service"
     "proton.VPN.service"
     "snapper-cleanup.timer"
     "snapper-timeline.timer"
-    "fail2ban"
+    "fail2ban.service"
     "fstrim.timer"
 )
 
@@ -165,6 +167,13 @@ for svc in "${SYSTEM_SERVICES[@]}"; do
     sudo systemctl enable --now "$svc"
 done
 
+# Set all AppArmor profiles to enforce mode
+log_info "Enforcing AppArmor profiles..."
+if command -v aa-enforce >/dev/null 2>&1; then
+    sudo aa-enforce /etc/apparmor.d/* 2>/dev/null || true
+else
+    log_warn "aa-enforce tool not found. AppArmor profiles will load in default mode via apparmor.service."
+fi
 # Restart active core services if already running
 log_info "Restarting active target services..."
 for svc in sshd fail2ban cups; do