Ubuntu
apparmor package

  1. Bug #974089
  2. Comment #3

Comment 3 for bug 974089

Revision history for this message
John Johansen (jjohansen) wrote : Re: AppArmor is loaded far to late in the boot process to confine services

Currently AppArmor's profile load is not done via upstart for various reasons see https://lists.ubuntu.com/archives/upstart-devel/2011-December/001771.html for some details.

Instead if the daemon has been switched to upstart profile load can be made dependent there as is done with /etc/init/avahi-daemon.conf

Instead of forcing all profiles to be loaded early which could affect boot speed, Ubuntu has opted to provide a split profile load (which does not seem to be documented atm) that will load some profiles early and the full profile set later in the boot sequence. To force a profile to be loaded early a symlink is dropped in
  /etc/apparmor/init/

see
  /etc/apparmor/init/network-interface-security/sbin.dhclient

as an example. As long as the profile cache is built adding all profiles should not significantly impact boot performance