AppArmor
AppArmor is a Linux security module that confines programs to a limited set of resources using per-program profiles. Each profile specifies which files, network access, and capabilities a process may use, reducing the damage a compromised application can cause.
itLinux | OpenSkills.info
Intro
AppArmor
AppArmor confines a Linux program to a declared set of allowed operations. It is a Linux Security Module, or LSM. The kernel enforces its policy after the usual discretionary access checks.
The practical goal is damage containment. A network service may need to read its configuration, bind a socket, and write its own state. It does not need every permission held by its Unix user. An AppArmor profile narrows that service to the resources and operations its workload requires.
The mental model
Follow one request through four parts:
- Process — a running program requests an operation from the kernel.
- Profile — AppArmor identifies the profile attached to that process.
- Rule — the profile allows matching file, capability, network, signal, ptrace, mount, D-Bus, or other mediated operations.
- Decision — enforce mode blocks an operation without permission. Complain mode permits it and records the violation for policy development.
AppArmor policy is allow-list oriented. When an enforcing profile has no rule that permits a mediated operation, the kernel denies it. An explicit deny rule also blocks access, but it can suppress routine audit noise.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://apparmor.net/
Supports
- AppArmor as mandatory access control for individual programs
- Kernel enforcement of per-application profiles
- Mediation of files, capabilities, sockets, D-Bus, and IPC
- Denial event fields and journal inspection example
- https://documentation.ubuntu.com/security/security-features/privilege-restriction/apparmor/
Supports
- AppArmor integration with the Linux Security Module framework
- Relationship between discretionary and mandatory access control
- Kernel profile lookup and policy decision sequence
- Capability, D-Bus, Unix-socket, and user-namespace restrictions
- Distribution version differences and AppArmor integration
- https://apparmor.net/profiles/profile-types-and-syntax/
Supports
- Profile headers, attachments, flags, and rule blocks
- Attached and unattached profile behavior
- Enforce as default mode and complain-mode behavior
- Runtime mode changes with `aa-complain` and `aa-enforce`
- Includes, abstractions, variables, and common mediated resource classes
- https://apparmor.net/reference/profiles-quick-reference/
Supports
- Implicit denial when no rule grants access
- Child profiles, hats, and variables
- Capability, network, signal, and ptrace rules
- File globbing and directory matching
- File permissions and execution transitions
- AppArmor file access as an additional control beyond DAC
- https://apparmor.net/profiles/Policy_Layout/
Supports
- Conventional `/etc/apparmor.d` policy layout
- Cache, disable, force-complain, local, abstractions, tunables, and namespaces directories
- Profile filename conventions for executable attachments
- https://ubuntu.com/server/docs/how-to/security/apparmor/
Supports
- Ubuntu package and profile locations
- `aa-status`, `aa-complain`, `aa-enforce`, and parser reload operations
- Profile creation with `aa-genprof`
- Profile updates with `aa-logprof`
- Audit denial interpretation and local customization
- Explicit-deny logging behavior
- https://apparmor.net/man/5.0/apparmor.d/
Supports
- Complete AppArmor profile grammar and rule classes
- File permissions, execution transitions, and rule qualifiers
- D-Bus mediation in cooperation with the D-Bus daemon
- Policy variables and feature-dependent rule syntax
- https://apparmor.net/man/master/apparmor_parser/
Supports
- Policy compilation and kernel loading
- Add, replace, and remove commands
- Namespace, cache, validation, and skip-kernel-load controls
- Privilege requirement for kernel policy administration
- https://apparmor.net/man/4.1/aa-status/
Supports
- Reporting loaded profiles, modes, and confined processes
- JSON output and script-oriented status options
- Exit-status meanings and root visibility limitation
- https://apparmor.net/man/master/aa-genprof/
Supports
- Interactive initial profile generation
- Complain-mode observation and log scanning cycle
- Transition to enforce mode after review completion
- https://apparmor.net/man/4.0/aa-logprof/
Supports
- Interactive audit-event review and profile updates
- File, execution, capability, and change-hat decisions
- Execute-transition choices and refusal to default to unconfined execution
- https://apparmor.net/monitoring/
Supports
- Audit records through auditd, kernel logs, and the system journal
- Denial monitoring for troubleshooting and policy maintenance
- Application changes as a trigger for profile review