Apparmor full system implementation help

I am trying to implement Apparmor full system implementation on Ubuntu Bionic in AWS EC2 instances. https://gitlab.com/apparmor/apparmor/-/wikis/FullSystemPolicy#distribution

My goal is employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system.

I have a couple of questions:

1. Following the link, I am not able to do profile init-systemd /lib/systemd/** because udevd and timesyncd disrupts the boot up process and box fails to reboot. So I have individually captured everything in /lib/systemd and added it to /etc/initramfs-tools/scripts/init-bottom/apparmor file.

echo "profile init-systemd /lib/systemd/systemd-logind flags=(complain) {}" | /sbin/apparmor_parser -a

echo "profile lib-systemd-systemd-journald /lib/systemd/systemd-journald flags=(complain) {}" | /sbin/apparmor_parser -a

echo "profile init-systemd /lib/systemd/systemd flags=(complain) {}" | /sbin/apparmor_parser -a

What can I do for udevd and timesyncd? How can I include them and still get a functioning box.

Secondly, right now I am passing empty profiles in /etc/initramfs-tools/scripts/init-bottom/apparmor. What is the best way to identify the permissions I should be giving in the profiles to achieve my goal?

Any help would be appreciated. Thanks

you can start by creating profiles in complain mod for udevd and timesyncd this way you can log violations without actually enforcing.

first we create the profiles

sudo touch /etc/apparmor.d/lib-systemd-udevd
sudo touch /etc/apparmor.d/lib-systemd-timesyncd

then edit them sudo nano /etc/apparmor.d/lib-systemd-udevd add those lines

#include <tunables/global>

/lib/systemd/systemd-udevd flags=(complain) {

}

then reload the profiles and set the complain mod:

sudo apparmor_parser -r -C /etc/apparmor.d/lib-systemd-udevd
sudo apparmor_parser -r -C /etc/apparmor.d/lib-systemd-timesyncd

then reboot and just check the logs sudo journalctl -b | grep apparmor

You can do the same to identify required permissions for other profiles.