--- title: "Getting Started with AppArmor: Linux Security Made Simple" description: Learn how to secure your Linux system with AppArmor, a simpler alternative to SELinux, and understand its profiles, modes, and logging features. image: https://blog.rheinwerk-computing.com/hubfs/Getting%20Started%20with%20AppArmor_%20Linux%20Security%20Made%20Simple.jpg --- [![Rheinwerk Computing Logo](https://blog.rheinwerk-computing.com/hubfs/computing_logo-header.svg)](https://blog.rheinwerk-computing.com/) [Blog](https://blog.rheinwerk-computing.com) - Books - Get an overview of our wide selection of books on every relevant computing topic. - [General Computing](https://www.sap-press.com/rheinwerk-computing/general-computing/) - [DevOps](https://www.sap-press.com/rheinwerk-computing/devops/) - [Programming Languages](https://www.sap-press.com/rheinwerk-computing/programming-languages/) - [Security](https://www.sap-press.com/rheinwerk-computing/security/) - [Software Development](https://www.sap-press.com/rheinwerk-computing/software-development/) - Book Subscription - Get unlimited access to all Rheinwerk Computing books! - [Programming Subscription](https://sap-press.com/subscriptions/) [Cybersecurity](https://blog.rheinwerk-computing.com/tag/cybersecurity) # Getting Started with AppArmor: Linux Security Made Simple ![Rheinwerk Computing](https://blog.rheinwerk-computing.com/hubfs/RW-logo-300x300.png) by [Rheinwerk Computing](https://blog.rheinwerk-computing.com/author/rheinwerk-computing) AppArmor is a Linux security module that helps protect your system by restricting what programs can do—without the complexity of SELinux.   Instead of adapting the complex SELinux system for its own distributions, the then owner of SUSE, Novell, bought the Immunix company, gave its security solution Subdomain the new name AppArmor, and placed it under the GNU General Public License (GPL). A few years later, AppArmor received the kernel developers’ accolade, so to speak, and was officially integrated into the kernel.   But after that, SUSE was silent on AppArmor. AppArmor remains in use, but no noticeable improvements have been made to either the rules or the admin tools in recent years. Instead, developers employed by Canonical have been responsible for the further development of AppArmor.   Like SELinux, AppArmor is a MAC security system. But in contrast to SELinux, App- Armor rules are based on absolute file names. For this reason, separate tagging of all files via EAs isn’t necessary; moreover, AppArmor also works for file systems that don’t support EAs.   Wildcards are allowed in the AppArmor rules. For this reason, AppArmor gets by with far fewer rules than SELinux for typical use cases.   However, there are also arguments against AppArmor: - Security experts at Red Hat believe that absolute paths in rules are an inherent security risk. AppArmor’s protection can be bypassed by renaming files or directories—which of course only succeeds if an attacker already has sufficient rights to do so. - The policy for AppArmor is not as comprehensive as that of SELinux. Fewer programs are protected by default. While it’s easier than with SELinux to create or change rules yourself, this kind of do-it-yourself security leaves a less than professional impression. ## How AppArmor Works on Ubuntu By default, AppArmor is integrated into the kernel on Ubuntu. The security system is started by systemd, takes into account the basic configuration from the */etc/apparmor* directory, and loads all rule files from the */etc/apparmor.d* directory.   When AppArmor is started, the securityfs file system is mounted in the */sys/kernel/ security* directory. Its files provide information about active profiles, the number of rule violations that occurred, and so on.   The aa-status command shows the following: - Total number of loaded profiles - Number of profiles in enforce mode - List of monitored services - Associated process IDs/ The following code listing shows which services of an Ubuntu root server are monitored:   `aa-status` `apparmor module is loaded.` `   14 profiles are loaded.` `   14 profiles are in enforce mode.` `      /usr/bin/freshclam` `      /usr/bin/man` `      ..` `   3 processes have profiles defined.` `   3 processes are in enforce mode.` `      /usr/bin/freshclam (919)` `      /usr/sbin/mysqld (816)` `      /usr/sbin/mysqld (24761) docker-default`    In other words, there are only three active programs actually under the control of AppArmor: in addition to the MySQL server (which runs in two instances, once using Docker), AppArmor monitors the freshclam program, which periodically updates the virus database for the mail server.   There are various other AppArmor profiles, but as the programs in question aren’t running, these profiles remain ineffective.   Conversely, of course, there are various other server services running on the server that should be monitored (Apache, Dovecot, Postfix, SpamAssassin, an SSH server), but again, there are no official AppArmor rule profiles for them. So, compared to an SELinux system, the protection is more than sparse.   ## Understanding AppArmor Profiles The effect of AppArmor depends on the monitoring rules. These rules are also referred to as *profiles* and are located in the files of the */etc/apparmor.d* directory. For example, the usr.sbin.cupsd file contains the profiles for the CUPS printer system.   The officially maintained rule profiles are usually provided by the respective package. Thus, the user.sbin.cupsd rule profile is available only if you have installed CUPS. For this reason, */etc/apparmor.d* is initially almost empty after an Ubuntu server installation and only fills up to the extent that you install server services.   ## Using AppArmor Modes: Enforce vs. Complain You can also install the apparmor-profiles package from the universe package source. It contains numerous other profiles, but they are not officially supported and maintained. Most profiles only run in the *complain* mode.   In this mode, rule violations are logged but not penalized. You can use the aa-enforce and aa-complain commands from the apparmor-utils package to change the mode of a profile. To do so, you need to pass the full path of the program to be monitored to the two commands:   `aa-enforce /usr/sbin/dnsmasq` `   Setting /usr/sbin/dnsmasq to enforce mode.`   `aa-complain /usr/sbin/dnsmasq` `   Setting /usr/sbin/dnsmasq to complain mode.`   Alternatively, you can pass aa-enforce and aa-complain the file names of the profile files. This makes it easy to change the mode of multiple profiles at once:   `cd /etc/apparmor.d` `aa-enforce usr.lib.dovecot*`   For server services, you must also restart the respective program after an AppArmor profile activation:   `systemctl restart ` ## Inside an AppArmor Profile File Rule files (profiles) have a plain text format. The following lines show part of the AppArmor rules for mysqld:   `# File /etc/apparmor.d/usr.sbin.mysqld` `#include `   `/usr/sbin/mysqld {` `   #include ` `   #include ` `   #include ` `   #include ` `   #include ` `   capability dac_override,` `   capability sys_resource,` `   capability setgid,` `   capability setuid,` `   network tcp,` `   /etc/hosts.allow               r,` `   ...` `   /etc/mysql/**                  r,` `   /usr/lib/mysql/plugin/         r,` `   /usr/lib/mysql/plugin/*.so*    mr,` `   /usr/sbin/mysqld               mr,` `   /usr/share/mysql/**            r,` `   /var/log/mysql.log             rw,` `   /var/log/mysql.err             rw,` `   ...` `   /run/mysqld/mysqld.sock        w,` `   /sys/devices/system/cpu/       r,` `   # Site-specific additions and overrides.` `   # See local/README for details.` `   #include ` `}`   In the rules files, some include files are read first before basic features of the program are defined. The other rules specify which files the program may use and how.   In AppArmor rules files, the wildcard character (\*) is a placeholder for any number of characters. A double asterisk (\*\*) has a similar meaning, but it includes the / character and thus includes files in all subdirectories. Access rights are expressed by letters or combinations of letters: - **r:** Allows read access - **w:** Allows write access - **a:** Allows expanding a file (append) - **l:** Applies the same rules to hard links as to the source file (link) - **k:** Allows blocking (lock) a file - **m:** Allows the mmap funcation (allow executable mapping) - **ix:** The programs inherits the rules of the base program (inherent execute) - **px:** The program has its own AppArmor profile (discrete profile execute) - **ux:** Executes the program without AppArmor rules (unconstrained execute)   ## Tuning AppArmor with Variables AppArmor provides a mechanism to change individual parameters of the rules in a simple way. These parameters are defined in the files of the */etc/apparmor.d/tunables* directory. In the current implementation, however, there are only a few parameters, which you can determine as follows:   `cd /etc/apparmor.d/tunables`   `cat $(find . -type f) | egrep '^@.*'` `   @{PROC}=/proc/` `   @{DOVECOT_MAILSTORE}=@{HOME}/Maildir/ @{HOME}/mail/ \` `      @{HOME}/Mail/ /var/vmail/ /var/mail/ /var/spool/mail/` `   @{securityfs}=@{sys}/kernel/security/` `   @{sys}=/sys/` `   @{apparmorfs}=@{securityfs}/apparmor/` `   @{HOME}=@{HOMEDIRS}/*/ /root/` `   @{HOMEDIRS}=/home/` `   ...` ## How AppArmor Logs Security Events Details about rule violations that occurred in complain or enforce mode are passed as kernel messages and are recorded by default in the */var/log/kern.log* and */var/log/syslog* files. You can recognize AppArmor messages by the audit keyword.   Some audit messages are simply an indicator that AppArmor rules are incomplete. Misbehavior in the program is of course also possible, but rather unlikely. Only an expert in the respective program can judge this with certainty. In this respect, an appropriate response to rule violations is difficult.   If you suspect that the affected program is working properly, you should switch the profile to the complain mode and report the audit message in the Ubuntu bug system ([*https://bugs.launchpad.net*](https://bugs.launchpad.net)).   You can find more information on AppArmor at the following websites: - [*https://wiki.ubuntu.com/AppArmor*](https://wiki.ubuntu.com/AppArmor) - [*http://s-prs.co/v5696114*](http://s-prs.co/v5696114)   Editor’s note: This post has been adapted from a section of the book *[Hacking and Security: The Comprehensive Guide to Penetration Testing and Cybersecurity](https://www.sap-press.com/hacking-and-security_5696/?utm_source=sappressblog&utm_medium=referral&utm_campaign=Blogs&utm_term=2425_chapter14&utm_content=2425) *by Michael Kofler, Klaus Gebeshuber, Peter Kloep, Frank Neugebauer, André Zingsheim, Thomas Hackner, Markus Widl, Roland Aigner, Stefan Kania, Tobias Scheible, and Matthias Wübbeling. These authors are a team of security specialists who have decades of experience working as penetration testers, administrators, and developers. Their unique expertise has taught them how hackers operate and they use this insight to teach others how to effectively defend systems against attacks.   This post was originally published in 4/2025. ## Recommendation [![Hacking and Security](https://blog.rheinwerk-computing.com/hs-fs/hubfs/social-suggested-images/2425-Jan-05-2024-11-10-28-8506-PM-1-3-3.jpg?width=170&name=2425-Jan-05-2024-11-10-28-8506-PM-1-3-3.jpg)](https://www.sap-press.com/hacking-and-security_5696/?utm_source=sappressblog&utm_medium=referral&utm_campaign=Blogs&utm_term=2425_chapter14&utm_content=2425) **Hacking and Security** Uncover security vulnerabilities and harden your system against attacks! With this guide you’ll learn to set up a virtual learning environment where you can test out hacking tools, from Kali Linux to hydra and Wireshark. Then expand your understanding of offline hacking, external safety checks, penetration testing in networks, and other essential security techniques, with step-by-step instructions. With information on mobile, cloud, and IoT security you can fortify your system against any threat! [Learn More](https://www.sap-press.com/hacking-and-security_5696/?utm_source=sappressblog&utm_medium=referral&utm_campaign=Blogs&utm_term=2425_chapter14&utm_content=2425) ![Rheinwerk Computing](https://blog.rheinwerk-computing.com/hubfs/RW-logo-300x300.png) **by [Rheinwerk Computing](https://blog.rheinwerk-computing.com/author/rheinwerk-computing)** Rheinwerk Computing is an imprint of Rheinwerk Publishing and publishes books by leading experts in the fields of programming, administration, security, analytics, and more. [Cybersecurity](https://blog.rheinwerk-computing.com/tag/cybersecurity) [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png)](https://www.facebook.com/share.php?u=https%3A%2F%2Fblog.rheinwerk-computing.com%2Fgetting-started-with-apparmor-linux-security-made-simple%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png)](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.rheinwerk-computing.com%2Fgetting-started-with-apparmor-linux-security-made-simple%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fblog.rheinwerk-computing.com%2Fgetting-started-with-apparmor-linux-security-made-simple%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fblog.rheinwerk-computing.com%2Fgetting-started-with-apparmor-linux-security-made-simple%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/email-color.png?width=24&name=email-color.png)](mailto:?subject=Check+out+https%3A%2F%2Fblog.rheinwerk-computing.com%2Fgetting-started-with-apparmor-linux-security-made-simple%3Futm_medium%3Dsocial%26utm_source%3Demail&body=Check+out+https%3A%2F%2Fblog.rheinwerk-computing.com%2Fgetting-started-with-apparmor-linux-security-made-simple%3Futm_medium%3Dsocial%26utm_source%3Demail) ### Comments ### Latest Blog Posts [![What Is a Bug Bounty Program?](https://blog.rheinwerk-computing.com/hs-fs/hubfs/What%20Is%20a%20Bug%20Bounty%20Program.png?height=600&name=What%20Is%20a%20Bug%20Bounty%20Program.png)](https://blog.rheinwerk-computing.com/what-is-a-bug-bounty-program) [What Is?](https://blog.rheinwerk-computing.com/tag/what-is) ## [What Is a Bug Bounty Program?](https://blog.rheinwerk-computing.com/what-is-a-bug-bounty-program) [Read More](https://blog.rheinwerk-computing.com/what-is-a-bug-bounty-program) [![What Is OAuth?](https://blog.rheinwerk-computing.com/hs-fs/hubfs/What%20Is%20OAuth.png?height=600&name=What%20Is%20OAuth.png)](https://blog.rheinwerk-computing.com/what-is-oauth) [Cybersecurity](https://blog.rheinwerk-computing.com/tag/cybersecurity) ## [What Is OAuth?](https://blog.rheinwerk-computing.com/what-is-oauth) [Read More](https://blog.rheinwerk-computing.com/what-is-oauth) **Subscribe to our blog!**Get notified about future blog updates. - - - ### The official Rheinwerk Computing Blog Rheinwerk Computing is an imprint of Rheinwerk Publishing and publishes resources that will help you accelerate your computing journey. The Rheinwerk Computing Blog is designed to provide helpful, actionable information on a variety of topics, including programming, administration, security, and analytics! ### Blog Topics - [All Topics](https://blog.rheinwerk-computing.com) - [Programming Languages](https://blog.rheinwerk-computing.com/tag/programming-languages) - [How To](https://blog.rheinwerk-computing.com/tag/how-to) - [JavaScript](https://blog.rheinwerk-computing.com/tag/javascript) - [DevOps](https://blog.rheinwerk-computing.com/tag/devops) - [Web Development](https://blog.rheinwerk-computing.com/tag/web-development) - [Python](https://blog.rheinwerk-computing.com/tag/python) - [What Is?](https://blog.rheinwerk-computing.com/tag/what-is) - [Cybersecurity](https://blog.rheinwerk-computing.com/tag/cybersecurity) - [Software Development](https://blog.rheinwerk-computing.com/tag/software-development) - [Java](https://blog.rheinwerk-computing.com/tag/java) ### Blog curated by [![Rheinwerk Computing Logo](https://blog.rheinwerk-computing.com/hubfs/computing_logo-header.svg)](https://www.sap-press.com/rheinwerk-computing/) [Visit Rheinwerk Computing Store](https://www.sap-press.com/rheinwerk-computing/) ### About - [Home](https://sap-press.com/) - [About Us](https://sap-press.com/the-publisher/) - [Contact](mailto:info@rheinwerk-publishing.com) - [Legal Notes](https://sap-press.com/legal-notes/) - [Privacy Policy](https://sap-press.com/privacy/) - [Terms of Use](https://sap-press.com/terms/) © 2026 Rheinwerk Publishing, Inc. | Change Privacy Options ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Rheinwerk Computing", "url" : "https://blog.rheinwerk-computing.com/author/rheinwerk-computing" }, "dateModified" : "2025-12-18T16:27:28.777Z", "datePublished" : "2025-04-28T13:00:00.000Z", "headline" : "Getting Started with AppArmor: Linux Security Made Simple", "image" : [ "https://blog.rheinwerk-computing.com/hubfs/Getting%20Started%20with%20AppArmor_%20Linux%20Security%20Made%20Simple.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.rheinwerk-computing.com/getting-started-with-apparmor-linux-security-made-simple", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.rheinwerk-computing.com/hubfs/Logo-1.jpg" }, "name" : "Rheinwerk Publishing, Inc." } } ```