apparmor

Display AppArmor status and loaded profiles

$ sudo aa-status

$ sudo aa-enforce [/etc/apparmor.d/usr.bin.firefox]

$ sudo aa-complain [/etc/apparmor.d/usr.bin.firefox]

$ sudo aa-disable [/etc/apparmor.d/usr.bin.firefox]

$ sudo systemctl reload apparmor

$ sudo aa-genprof [/usr/bin/application]

$ sudo aa-logprof

aa-status [options]
aa-enforce profile
aa-complain profile
aa-disable profile
aa-genprof executable
aa-logprof

AppArmor (Application Armor) is a Linux Security Module that provides Mandatory Access Control (MAC) for programs. It confines applications using per-program security profiles that restrict file access, network capabilities, and other system resources.
Profiles operate in two modes: enforce mode blocks and logs violations, while complain mode only logs without blocking, useful for developing and testing new profiles.
The aa-status command displays loaded profiles and their modes. Use aa-enforce and aa-complain to switch profile modes. The aa-genprof tool generates new profiles by running an application and learning its behavior, while aa-logprof refines existing profiles based on logged events.
Profiles are stored in /etc/apparmor.d/ and loaded at boot. The AppArmor service manages profile loading via systemd on modern distributions.

aa-status

Display the current state of AppArmor, including loaded profiles and their modes

Set a profile to enforce mode (blocks policy violations)

Set a profile to complain mode (logs violations without blocking)

Disable a profile entirely

Generate a new profile for an application interactively

Update profiles based on events logged in complain mode

List processes running without AppArmor confinement

Display detailed information (aa-status)

Show only enforced profile count (aa-status)

Show only complaining profile count (aa-status)

aa-status returns: 0 = AppArmor enabled with policy loaded, 1 = AppArmor not enabled, 2 = AppArmor enabled but no policy loaded, 3 = AppArmor control files not available, 4 = insufficient privileges.

Most AppArmor commands require root privileges. Profiles in enforce mode can break application functionality if the policy is too restrictive. Test new profiles in complain mode first. The apparmor-utils package must be installed for profile management tools.

AppArmor was developed by Immunix Inc. in the late 1990s and acquired by Novell in 2005. It became part of the mainline Linux kernel in version 2.6.36 (2010). Ubuntu has included AppArmor by default since version 7.10 (2007), and it is also available on Debian, SUSE, and other distributions as an alternative to SELinux.

aa-status(8), aa-enforce(8), aa-complain(8), aa-notify(8), selinux(8)