AppArmor

AppArmor, short for Application Armor, is a Linux kernel security module that implements Mandatory Access Control by confining individual applications with per-program security profiles. Profiles specify what files an application can read or write, which network resources it may access, what capabilities it can gain, and other interactions with the system, all based on the program’s path. This path-based confinement makes it relatively straightforward to write policies for specific applications without requiring comprehensive system-wide policy.

Profiles are managed by userspace tools and stored as plain-text files under /etc/apparmor.d. When a program starts, the kernel applies its loaded profile. If the program attempts an action not permitted by its profile, the action is blocked; in complain mode, violations are merely logged to aid policy development. The typical modes are enforce and complain.

Administrators can load, switch, and inspect profiles with tools such as aa-status, aa-enforce, aa-complain, aa-genprof, and aa-logprof. A profile author can specify literal file paths, wildcarded patterns, and granularity to limit access to specific directories and resources.

AppArmor is maintained for Linux distributions that ship with it, notably SUSE and Ubuntu, and is one of several LSM-based MAC implementations. It emphasizes ease of policy creation and predictable confinement, at the cost of potentially less completeness than some alternatives. It coexists with other security mechanisms and can be used in parallel with or instead of SELinux, depending on the distribution and policy requirements.