AppArmor

AppArmor profiles, complain vs enforce mode, aa-genprof, aa-logprof, and path-based MAC.

Overview

AppArmor is a Mandatory Access Control (MAC) system for Linux that confines programs to a limited set of resources. Unlike SELinux which labels every file with a security context, AppArmor uses path-based profiles — rules that reference filesystem paths directly. This makes AppArmor significantly easier to write and audit than SELinux, at the cost of some flexibility.

AppArmor is the default MAC system on Ubuntu, Debian, and SUSE distributions, while RHEL/Fedora use SELinux.

Profile Anatomy

A profile lives in /etc/apparmor.d/ and has this general structure:

File Permission Letters

r — read
w — write
x — execute
k — lock
m — mmap
l — link

Two Enforcement Modes

Enforce — violations are blocked and logged. The profile is fully active.

Complain — violations are logged but not blocked. Use for profile development and auditing. Equivalent to SELinux permissive mode for that specific profile.

Profiles can be in different modes simultaneously — you can put a new custom app profile in complain while leaving all system profiles in enforce.

Key concepts

Profile: A file in /etc/apparmor.d/ defining which files, capabilities, and network resources a binary may access. Keyed by the absolute path to the binary.
Enforce mode: Policy violations are blocked and logged. The profile is fully active. Set with aa-enforce /etc/apparmor.d/profile.
Complain mode: Policy violations are logged but allowed. Used for profile development. Set with aa-complain /etc/apparmor.d/profile. Equivalent to SELinux permissive for that profile.
aa-genprof: Interactive profile generator. Runs the application, monitors what it accesses, and interactively asks you to allow or deny each access. Produces an initial profile.
aa-logprof: Reads log events from a profile in complain mode and interactively offers to add allow rules to the profile. Use after exercising the application in complain mode.
Abstractions: Reusable profile snippets in /etc/apparmor.d/abstractions/. #include grants access to common libraries. Reduces boilerplate in profiles.

When to use it

Confining a third-party application to only the paths it legitimately needs — aa-genprof to build an initial profile
Hardening Docker/container workloads on Ubuntu — Docker ships a default AppArmor profile applied to all containers
Investigating why an application is blocked — check /var/log/syslog or journalctl for DENIED messages
Iteratively building a profile with aa-logprof — run in complain mode, exercise the app, then review and add denials as allow rules
Auditing which profiles are loaded and their modes — aa-status

Interview questions

How do you create an AppArmor profile for a new custom application?
How does AppArmor compare to SELinux? When would you choose one over the other?