CKS System Hardening Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  apparmor_load /path/to/profile

  Why it's wrong here

  apparmor_load is not an executable shipped with the AppArmor userspace suite; the actual interface for loading a profile into the kernel is apparmor_parser, which parses a human-readable profile and writes the binary policy through the securityfs '.load' file. Running `apparmor_load /path/to/profile` would simply fail with 'command not found', and even if an alias existed, you would still need to invoke apparmor_parser with the correct flags. Because no standard tool by that name exists, it cannot be the correct command to load a profile.

• ✗

  aa-load /path/to/profile

  Why it's wrong here

  aa-load is not a standard command in the apparmor-utils package either; the closest tool is apparmor_parser, and apparmor-utils provides programs like aa-status, aa-enforce, aa-complain, and aa-genprof, but none is named aa-load. Some third-party scripts may use that name, but they are not the canonical way to load profiles. Since the question asks for the command that loads a profile into the kernel, aa-load is a plausible-sounding but nonexistent binary and therefore incorrect.

• ✗

  aa-status /path/to/profile

  Why it's wrong here

  aa-status (also available as apparmor_status) queries the kernel's loaded profiles and reports their enforcement mode (enforce, complain, or unconfined) by reading /sys/kernel/security/apparmor/profiles; it performs no write operation to the kernel. Passing a profile path to aa-status would be interpreted as checking that profile's status, not installing it, and the command would exit with an error if the profile isn't already loaded. Displaying status never modifies kernel policy, so this option is wrong for a load action.

• ✓

  apparmor_parser -r /path/to/profile

  Why this is correct

  `apparmor_parser -r /path/to/profile` is the legitimate way to load (or replace) an AppArmor profile: it reads the textual profile file, parses it into the binary policy format, and writes that policy to the kernel through the AppArmor securityfs interface. The `-r` flag means 'replace' an existing profile with the same name; to add a new profile, you would use `-a` or omit the flag (the default is add). Because the kernel only understands the compiled policy, apparmor_parser is the required userspace bridge and thus correctly loads the profile.

Go deeper

Related to this question