AppArmor Commands

AppArmor security profile management and troubleshooting commands.

Status & Information

sudo aa-status

Show AppArmor status and loaded profiles

sudo aa-enabled

Check if AppArmor is enabled

cat /sys/kernel/security/apparmor/profiles

List all loaded profiles

cat /sys/module/apparmor/parameters/enabled

Check kernel module status

sudo apparmor_status

Alternative status command

dmesg | grep apparmor

View AppArmor kernel messages

journalctl -k | grep apparmor

View AppArmor journal logs

Profile Modes

sudo aa-enforce /etc/apparmor.d/usr.bin.firefox

Set profile to enforce mode

sudo aa-complain /etc/apparmor.d/usr.bin.firefox

Set profile to complain mode

sudo aa-disable /etc/apparmor.d/usr.bin.firefox

Disable a profile

sudo aa-audit /etc/apparmor.d/usr.bin.firefox

Set profile to audit mode

sudo aa-enforce /etc/apparmor.d/*

Enforce all profiles

sudo aa-complain /etc/apparmor.d/*

Set all profiles to complain

Profile Management

sudo apparmor_parser -r /etc/apparmor.d/usr.bin.firefox

Reload a specific profile

sudo apparmor_parser -R /etc/apparmor.d/usr.bin.firefox

Remove/unload a profile

sudo apparmor_parser /etc/apparmor.d/usr.bin.firefox

Load a profile

sudo apparmor_parser -r /etc/apparmor.d/

Reload all profiles

sudo systemctl reload apparmor

Reload AppArmor service

sudo systemctl restart apparmor

Restart AppArmor service

Profile Generation

sudo aa-genprof /usr/bin/myapp

Generate profile for application

sudo aa-autodep /usr/bin/myapp

Create basic profile skeleton

sudo aa-logprof

Update profiles from logs (interactive)

sudo aa-easyprof --template=user-application /usr/bin/myapp

Generate profile from template

sudo aa-unconfined

List unconfined processes with network access

sudo aa-unconfined --paranoid

List all unconfined processes

Service Control

sudo systemctl start apparmor

Start AppArmor service

sudo systemctl stop apparmor

Stop AppArmor service

sudo systemctl enable apparmor

Enable AppArmor at boot

sudo systemctl disable apparmor

Disable AppArmor at boot

sudo systemctl status apparmor

Check AppArmor service status

sudo update-rc.d apparmor defaults

Enable AppArmor (SysV init)

Logging & Debugging

sudo tail -f /var/log/syslog | grep apparmor

Monitor AppArmor logs

sudo tail -f /var/log/audit/audit.log | grep apparmor

Monitor audit logs

sudo aa-notify -s 1 -v

Show AppArmor notifications

sudo ausearch -m avc -ts recent

Search recent denials

sudo dmesg | grep -i denied

View kernel denial messages

cat /var/log/kern.log | grep apparmor

Check kernel log for AppArmor

Profile Utilities

sudo aa-decode <hex_string>

Decode hex-encoded path from logs

sudo aa-exec -p profile_name -- command

Run command under specific profile

sudo aa-cleanprof /etc/apparmor.d/usr.bin.myapp

Clean up profile rules

sudo aa-mergeprof profile1 profile2

Merge two profiles

apparmor_parser -p /etc/apparmor.d/usr.bin.myapp

Parse and display profile

Namespace & Policy

cat /proc/self/attr/current

Show current process confinement

cat /proc/<pid>/attr/current

Show process confinement by PID

sudo aa-features-abi /etc/apparmor.d/abi/3.0

Show feature ABI

ls /etc/apparmor.d/tunables/

List tunable variables

ls /etc/apparmor.d/abstractions/

List available abstractions

Configuration Files

ls /etc/apparmor.d/

List all profile files

cat /etc/apparmor/parser.conf

View parser configuration

sudo nano /etc/apparmor.d/local/<profile>

Edit local overrides

ls /etc/apparmor.d/disable/

List disabled profiles

sudo ln -s /etc/apparmor.d/usr.bin.myapp /etc/apparmor.d/disable/

Disable profile via symlink

Common Profiles

sudo apt install apparmor-profiles

Install additional profiles (Debian/Ubuntu)

sudo apt install apparmor-profiles-extra

Install extra profiles

sudo aa-enforce /etc/apparmor.d/usr.sbin.nginx

Enforce nginx profile

sudo aa-enforce /etc/apparmor.d/usr.sbin.apache2

Enforce Apache profile

sudo aa-enforce /etc/apparmor.d/usr.sbin.mysqld

Enforce MySQL profile