Add new rule grub2_enable_apparmor

[dodys]

Description:

• In Ubuntu 22.02 CIS we have: 1.6.1.2 Ensure AppArmor is enabled in the bootloader configuration
• This rule was also missing for Ubuntu 20.04 and apparently it is also missing for SLE15 (1.7.1.2 Ensure AppArmor is enabled in the bootloader configuration) @teacup-on-rockingchair I am tagging you here as I imagine this is also needed for SUSE.

Rationale:

• AppArmor must be enabled at boot time in your bootloader configuration to ensure that the controls it provides are not overridden.

Review Hints:

• Audit

# grep "^\s*linux" /boot/grub/grub.cfg | grep -v "apparmor=1"
Nothing should be returned
# grep "^\s*linux" /boot/grub/grub.cfg | grep -v "security=apparmor"
Nothing should be returned

• Remediation
  Edit /etc/default/grub and add the apparmor=1 and security=apparmor parameters to the GRUB_CMDLINE_LINUX= line
  GRUB_CMDLINE_LINUX="apparmor=1 security=apparmor"
  Run the following command to update the grub2 configuration: (Ubuntu specific here)
  # update-grub

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

ubuntu2004 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[codeclimate]

Code Climate has analyzed commit efca9d2 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 49.8% (0.0% change).

View more on Code Climate.

[Mab879]

/retest

[Mab879]

LGTM. Overriding the CODEOWNERS restriction since the user who opens a PR can't approve it.