From a7802fb1a8bdedf3b13cf7c4c8177300d2cd4a4c Mon Sep 17 00:00:00 2001
From: Denis Chevalier <perso@denischevalier.fr>
Date: Thu, 6 Aug 2026 16:44:21 +0200
Subject: add apparmor and audit

---
 setup.sh | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

(limited to 'setup.sh')

diff --git a/setup.sh b/setup.sh
index db22db7..b07758f 100755
--- a/setup.sh
+++ b/setup.sh
@@ -151,13 +151,15 @@ systemctl --user enable ssh-agent.socket
 # Enable System-Level Services
 log_info "Enabling system-level services and timers..."
 SYSTEM_SERVICES=(
+    "apparmor.service"
+    "auditd.service"
     "reflector.timer"
     "paccache.timer"
     "keyd.service"
     "proton.VPN.service"
     "snapper-cleanup.timer"
     "snapper-timeline.timer"
-    "fail2ban"
+    "fail2ban.service"
     "fstrim.timer"
 )
 
@@ -165,6 +167,13 @@ for svc in "${SYSTEM_SERVICES[@]}"; do
     sudo systemctl enable --now "$svc"
 done
 
+# Set all AppArmor profiles to enforce mode
+log_info "Enforcing AppArmor profiles..."
+if command -v aa-enforce >/dev/null 2>&1; then
+    sudo aa-enforce /etc/apparmor.d/* 2>/dev/null || true
+else
+    log_warn "aa-enforce tool not found. AppArmor profiles will load in default mode via apparmor.service."
+fi
 # Restart active core services if already running
 log_info "Restarting active target services..."
 for svc in sshd fail2ban cups; do
-- 
cgit