AppArmor restricts what individual applications can do — which files they can access, what network operations they can perform — limiting the damage a compromised application can cause, even if it has a vulnerability.
What AppArmor Provides
Mandatory access control confining programs to a limited set of resources, defined by a profile — even if an application is exploited, AppArmor's confinement limits what the attacker can actually do through that specific application.
AppArmor Is Often Already Active
sudo aa-statusUbuntu ships with AppArmor enabled by default, with profiles for several common services already active — check current status before assuming you're starting from nothing.
Understanding Profile Modes
| Mode | Behavior |
|---|---|
| Enforce | Actively blocks actions violating the profile |
| Complain | Logs violations without blocking — useful for testing a new profile |
Viewing Existing Profiles
ls /etc/apparmor.d/Creating a Basic Custom Profile
sudo aa-genprof /usr/bin/your-applicationInteractively walks through your application's actual behavior, generating a profile based on observed file/network access — run your application normally through its typical operations while this tool is active, then review and approve suggested rules.
Example Profile Structure
#include <tunables/global>
/usr/bin/myapp {
#include <abstractions/base>
/var/www/myapp/** r,
/var/log/myapp/*.log w,
network inet stream,
deny /etc/shadow r,
deny /home/** rw,
}Putting a Profile into Enforce Mode
sudo aa-enforce /etc/apparmor.d/usr.bin.myappTesting in Complain Mode First (Recommended)
sudo aa-complain /etc/apparmor.d/usr.bin.myappRun your application through its normal full range of operations while in complain mode, reviewing logs for any legitimate operation the profile would have blocked, before switching to enforce mode.
Reviewing AppArmor Denial Logs
sudo journalctl | grep apparmor | grep DENIEDShows what the profile blocked — review these to distinguish between genuine attack attempts and legitimate operations your profile needs to be adjusted to allow.
Reloading a Profile After Changes
sudo apparmor_parser -r /etc/apparmor.d/usr.bin.myappCommon Services with Existing AppArmor Profiles
Many common packages (some web servers, some database systems) ship with their own AppArmor profiles already — check /etc/apparmor.d/ before assuming you need to create one from scratch for standard software.
AppArmor vs SELinux
Both accomplish similar mandatory access control goals through different approaches — AppArmor uses path-based rules (generally considered simpler to configure); SELinux uses label-based rules (more granular but steeper learning curve) and is the standard on RHEL-family distributions like AlmaLinux/Rocky Linux.
Common Errors
Application fails to start after enabling enforce mode — switch back to complain mode temporarily, review denial logs for what was blocked, adjust the profile, and retest before re-enabling enforce mode.
Continue Reading
- How to Implement the Principle of Least Privilege on a Linux VPS
- How to Set Up File Integrity Monitoring with AIDE
- How to Audit and Fix File and Directory Permissions on a Linux VPS
Browse more articles in Server Security & Hardening.
