diff --git a/AppArmorInSystemd.md b/AppArmorInSystemd.md index 7c6d9b0..c4393f8 100644 --- a/AppArmorInSystemd.md +++ b/AppArmorInSystemd.md @@ -19,10 +19,15 @@ Early policy loads are required to confine systemd, and other early services or ## Early policy loads -Requires +Early policy must be precompiled binary (cache) that matches the kernel being booted and it must be placed in + +``` +/etc/apparmor/earlypolicy +``` + +The cache placed in ```/etc/apparmor/earlypolicy``` is expected to to conform to the per kernel directory hierarchy of regular cache. + -- all policy to be loaded to have precompiled cache that is available during early boot. - - cache must be in a location that is available eg. /etc/apparmor.d/cache or /lib/apparmor/cache. Cache in /var/cache/apparmor/ can NOT be used. ???? - Load is not parallel with other units