NODELOG by THIVELAB
Subscribe
Home/Engineer/Security Hardening/AppArmor Basics — A Practica…
Security HardeningIntermediateUbuntuDebianapparmorSecuritymac

AppArmor Basics — A Practical Guide to Restricting Process Privileges

Covers AppArmor modes, applying and disabling existing profiles, creating new profiles with aa-genprof, log analysis, and Nginx and MySQL profile examples.

NONodelog0 views
Contents
  1. What is AppArmor?
  2. Installation and Status Check
  3. The Three Modes
  4. Managing Existing Profiles
  5. Creating a New Profile (aa-genprof)
  6. Manual Profile Writing Example
  7. Log Analysis

What is AppArmor?

AppArmor is a Linux MAC (Mandatory Access Control) security module that uses profiles to restrict which files, networks, and capabilities a process can access. It is Ubuntu’s default security module.

Installation and Status Check

Bash
# Preinstalled on most Ubuntu systems
sudo apt install -y apparmor apparmor-utils

# Check status
sudo aa-status
sudo apparmor_status

# List of loaded profiles
sudo aa-status | grep -A100 "profiles are loaded"

The Three Modes

ModeDescription
enforceBlock policy violations and log them
complainLog only, without blocking (for development and testing)
disabledAppArmor disabled
Bash
# Put a specific profile into complain mode
sudo aa-complain /usr/sbin/nginx

# Switch to enforce mode
sudo aa-enforce /usr/sbin/nginx

# Disable a specific profile
sudo aa-disable /usr/sbin/nginx

# Inspect all profiles
sudo aa-status --verbose

Managing Existing Profiles

Bash
# Profile location
ls /etc/apparmor.d/

# Load a profile (after editing the file)
sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.nginx

# Reload all profiles
sudo systemctl reload apparmor

# Unload a specific profile
sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.nginx

Creating a New Profile (aa-genprof)

Bash
# Auto-generate a profile (learn by running the program)
sudo aa-genprof /usr/local/bin/myapp

# 1. Run and test myapp in another terminal
# 2. Enter S (scan) at the aa-genprof prompt
# 3. Choose Allow/Deny for each access
# 4. Finish with F (finish)

Manual Profile Writing Example

CODE
# /etc/apparmor.d/usr.sbin.nginx
#include <tunables/global>

/usr/sbin/nginx {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  capability net_bind_service,
  capability setuid,
  capability setgid,

  # Executable
  /usr/sbin/nginx mr,

  # Read config files
  /etc/nginx/** r,

  # Write logs
  /var/log/nginx/ rw,
  /var/log/nginx/** rw,

  # Read web root
  /var/www/html/** r,

  # PID file
  /run/nginx.pid rw,

  # Socket
  network inet stream,
  network inet6 stream,

  # Deny: all other access
}
Bash
# Apply the profile
sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.nginx
sudo aa-enforce /usr/sbin/nginx

Log Analysis

Bash
# AppArmor denial logs
sudo dmesg | grep -i apparmor
sudo journalctl -k | grep "apparmor.*DENIED"

# Audit logs
sudo grep "apparmor" /var/log/syslog | tail -30
sudo grep "apparmor" /var/log/kern.log | tail -30

# Add what was learned in complain mode to the profile
sudo aa-logprof   # Analyze logs and automatically suggest rules
#apparmor#Security#mac#linux#Containers
Editorial note

AI tools may assist drafting. Check the evidence in each guide for whether commands were run and which environment was used. Confirm the current docs for your version before applying instructions, and email us about errors. email us

Topic-related official docs (auto-linked · not per-claim sources)Docker documentation ↗MySQL manual ↗NGINX documentation ↗Linux man pages ↗
How we write and review →Editorial policy →

Questions & answers

Ask a question about this guide. We'll review and reply.