How to Completely Disable ‘AppArmor’ Security Profiles for specific applications in Ubuntu

Ubuntu utilizes a powerful kernel security module called AppArmor. It acts as a mandatory access control system, locking down applications by strictly defining which files they can read, write, or execute. If a program attempts to access a directory outside of its assigned AppArmor profile, the kernel violently terminates the action and logs an “apparmor=DENIED” error, even if you ran the program as the root user.

While AppArmor is a critical security layer that prevents compromised applications from destroying your system, it can be incredibly frustrating for system administrators deploying custom software. If you install a database (like MySQL) but attempt to move its data directory to a custom mounted hard drive (e.g., /mnt/storage/mysql), AppArmor will instantly block MySQL from starting because the new directory is not in its authorized profile. To troubleshoot these blocks, or to run a trusted application in a completely unrestricted environment, you must disable its AppArmor profile.

Disabling a Specific AppArmor Profile via Symlink

You should almost never disable AppArmor globally across the entire operating system. Instead, you can disable the security profile for one specific application while leaving the rest of the system protected.

1. Open a Terminal session (or connect via SSH).
2. AppArmor profiles are stored in /etc/apparmor.d/. To disable a profile, you must create a symbolic link (symlink) pointing it to the special disable folder.
3. For example, if you want to disable the profile for MySQL, you would run the following command (replace usr.sbin.mysqld with the actual name of the profile you are targeting):
   sudo ln -s /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/disable/

Parsing the Change into the Kernel

Simply creating the symlink does not stop the kernel from enforcing the rule immediately. You must instruct the AppArmor parser to aggressively remove the profile from the active kernel.

1. In the terminal, run the following command, pointing it to the profile you just disabled:
   sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld
2. (The -R flag stands for Remove, completely stripping the rules from memory).
3. To verify that the profile is truly gone, you can run the status command:
   sudo aa-status
4. Look through the output. The application you targeted should no longer appear in the “enforce mode” list.

The application is now completely unconstrained by AppArmor. It will rely solely on standard Linux file permissions (chmod/chown) for security, allowing you to move its data directories or run custom scripts without the kernel interfering.