From /proc/config.gz:
CONFIG_SECURITY_APPARMOR=y
CONFIG_SECURITY_APPARMOR_HASH=y
CONFIG_SECURITY_APPARMOR_HASH_DEFAULT=y
# CONFIG_SECURITY_APPARMOR_DEBUG is not set
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
"If AppArmor is not the default security module it can be enabled by passing security=apparmor on the kernel’s command line."
Kernel docs (https://www.kernel.org/doc/html/v4.14/admin-guide/LSM/apparmor.html)
It looks promising from the kernel config aspect, although you might need that command line addition, possibly adding it with /etc/default/grub.