add apparmor and audit

1 files changed, 10 insertions, 1 deletions

diff --git a/setup.sh b/setup.sh
index db22db7..b07758f 100755
--- a/setup.sh
+++ b/setup.sh
@@ -151,13 +151,15 @@ systemctl --user enable ssh-agent.socket
 # Enable System-Level Services
 log_info "Enabling system-level services and timers..."
 SYSTEM_SERVICES=(
+    "apparmor.service"
+    "auditd.service"
     "reflector.timer"
     "paccache.timer"
     "keyd.service"
     "proton.VPN.service"
     "snapper-cleanup.timer"
     "snapper-timeline.timer"
-    "fail2ban"
+    "fail2ban.service"
     "fstrim.timer"
 )
 
@@ -165,6 +167,13 @@ for svc in "${SYSTEM_SERVICES[@]}"; do
     sudo systemctl enable --now "$svc"
 done
 
+# Set all AppArmor profiles to enforce mode
+log_info "Enforcing AppArmor profiles..."
+if command -v aa-enforce >/dev/null 2>&1; then
+    sudo aa-enforce /etc/apparmor.d/* 2>/dev/null || true
+else
+    log_warn "aa-enforce tool not found. AppArmor profiles will load in default mode via apparmor.service."
+fi
 # Restart active core services if already running
 log_info "Restarting active target services..."
 for svc in sshd fail2ban cups; do