Simple definition
AppArmor is a Linux Mandatory Access Control (MAC) mechanism that limits what an application is allowed to do by applying security profiles.
Technical definition
AppArmor is implemented through the Linux Security Modules framework. Profiles describe permitted access to files, capabilities, signals, network resources, and other operations. In enforce mode, policy violations are blocked and logged; in complain mode, violations are mainly logged to help develop or tune a profile.
What is it used for?
Reduce the impact of a compromise by confining an application to the resources it actually needs.
Practical example
A compromised web service tries to read a file outside the paths allowed by its AppArmor profile. In enforce mode the access is denied and the event is recorded in the security logs.
Common issues
- Profile is not loaded or the service is running unconfined
- Profile is too restrictive and blocks legitimate operations
- Profile was left in complain mode in production
- Required path, permission, or capability is missing from the profile
Key takeaway: Check aa-status and AppArmor logs before disabling a profile; a DENIED entry often identifies the exact permission that needs review.