Verify The Environment

Later sections lean on kernel features (seccomp, namespaces, an enforcing LSM) and a handful of userland tools. If those are missing or disabled, exercises fail in confusing ways that look like your mistake but are really an environment gap. Spending five minutes now to confirm the kernel and install the toolkit saves hours of debugging later. You end this page with a verified lab and a fresh baseline snapshot that includes the tools.

Start from the clean snapshot taken in Local Setup.

Kernel Version And Security Features

First confirm the kernel. Ubuntu 24.04 ships the 6.8 series, which has every feature this foundation uses.

uname -r

Expected output:

6.8.0-45-generic

Next, check the security features that the process and container sections depend on. Seccomp filters syscalls, namespaces isolate resources, and a Linux Security Module (LSM) enforces mandatory policy. Confirm each is present.

grep -H . /sys/module/apparmor/parameters/enabled
grep SECCOMP /boot/config-$(uname -r)
zgrep CONFIG_USER_NS /boot/config-$(uname -r)

Expected output:

/sys/module/apparmor/parameters/enabled:Y
CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y
CONFIG_USER_NS=y

Y for AppArmor means an LSM is active. CONFIG_SECCOMP_FILTER=y and CONFIG_USER_NS=y mean the kernel supports seccomp syscall filtering and user namespaces. To see which LSM is enforcing and which profiles are loaded:

cat /sys/kernel/security/lsm
sudo aa-status --enabled && echo "AppArmor enforcing"

Expected output:

lockdown,capability,landlock,yama,apparmor
AppArmor enforcing

The comma-separated list is every LSM the kernel built in; apparmor appearing there, plus aa-status succeeding, confirms mandatory access control is live. On a Fedora or RHEL lab you would see selinux instead and use getenforce.

Installing The Toolkit

The foundation uses a small, deliberate set of tools beyond the base install. Install them once so every later page just works.

Package	Provides	Used for
acl	getfacl, setfacl	Fine-grained permissions in ACLs & Attributes
libcap2-bin	getcap, setcap	File capabilities auditing
auditd	audit daemon and ausearch	Recording security-relevant events
net-tools	netstat, ifconfig	Legacy network views alongside ss
tree	tree	Visualizing directory permission layouts

sudo apt update
sudo apt install -y acl libcap2-bin auditd net-tools tree

Expected output:

Reading package lists... Done
...
The following NEW packages will be installed:
  acl auditd libcap2-bin net-tools tree
...
Setting up auditd (3.1.2-2.1build1) ...
Processing triggers for man-db (2.12.0-4build2) ...

Verify the key binaries resolve:

command -v getfacl setfacl getcap auditctl

Expected output:

/usr/bin/getfacl
/usr/bin/setfacl
/usr/sbin/getcap
/usr/sbin/auditctl

If any line is blank, that package did not install; re-run the apt install for it before continuing.

Record A Clean Baseline Snapshot

The snapshot from Local Setup predates the toolkit, so take a second one now that the environment is verified and complete. This becomes your true starting point for every exercise: kernel confirmed, tools present, nothing yet broken.

exit                       # leave the VM shell, back on the host
multipass stop lab
multipass snapshot lab --name verified-baseline
multipass start lab

Expected output:

Snapshot taken: lab.verified-baseline

From here on, “reset the lab” means multipass restore lab.verified-baseline. With the environment proven and captured, you are ready for the access-control material in Users & Groups and the rest of the Users & Permissions group.

Practical Guidance

1. Confirm uname -r shows a 6.x kernel before trusting any feature check; an old kernel changes behavior.
2. Treat the LSM check as pass/fail: if aa-status errors or the list omits apparmor, fix that before doing process-isolation work.
3. Install the whole toolkit in one pass so later pages never stop to install a missing binary.
4. Verify binaries with command -v rather than assuming the package installed; a failed postinstall can leave gaps.
5. Snapshot the verified state and restore to it, not the bare install, at the start of each exercise.