How to Configure AppArmor Profiles and Enforce Mode in Ubuntu

Modern Linux server security demands robust defense-in-depth mechanisms that protect system resources even when a network daemon suffers a remote code execution exploit. Traditional discretionary access controls (user/group read, write, and execute permissions) allow any compromised service running under an administrative or unconfined account to traverse the entire filesystem. In Ubuntu, AppArmor (Application Armor) provides Mandatory Access Control (MAC) implemented via Linux Security Modules (LSM). AppArmor confines individual binaries to strict, path-based capability profiles, restricting network sockets, raw packet generation, and file access regardless of process ownership.

Understanding AppArmor Operational Modes

Every AppArmor security profile operates in one of two distinct modes:

• Complain Mode: The security profile monitors the application’s runtime behavior. Policy violations are not blocked; instead, security audit events are logged to /var/log/audit/audit.log or systemd journal logs. This mode is essential when developing, testing, or auditing complex software.
• Enforce Mode: The profile strictly enforces all defined access boundaries. Any attempt by the confined process to read files, execute sub-processes, or open network sockets outside its explicit ruleset is immediately blocked by the kernel and logged.

Checking AppArmor Status and Active Profiles

AppArmor ships installed and active by default on standard Ubuntu Server and Desktop installations:

# Display overall status, loaded profiles, and process confinement
sudo aa-status

The command output breaks down active security metrics:

• Total number of loaded profiles across enforce and complain modes.
• Lists running system processes currently confined by loaded profiles (e.g., dnsmasq, named, mysqld, or container runtimes).
• Identifies running processes with active profiles that are unconfined or operating in complain mode.

Switching Between Enforce and Complain Modes

To manipulate profile enforcement states, install the standard AppArmor management utilities:

sudo apt update && sudo apt install -y apparmor-utils

Once installed, toggle profile operational states using intuitive binary commands:

# Place a profile into Complain mode for non-disruptive monitoring
sudo aa-complain /etc/apparmor.d/usr.sbin.nginx

# Re-enable strict Enforce mode after validating behavior
sudo aa-enforce /etc/apparmor.d/usr.sbin.nginx

# Reload all profiles from disk into the Linux kernel
sudo systemctl reload apparmor

Generating Custom AppArmor Profiles with aa-genprof

When deploying custom internal microservices or unconfined third-party daemons, you can generate a tailored profile through interactive profiling:

1. Start the profile generation wizard:

   sudo aa-genprof /usr/local/bin/custom_daemon

2. In a separate terminal window, exercise all standard operations of your application (trigger HTTP endpoints, run database migrations, and handle client sessions).
3. Return to the aa-genprof terminal and press S to scan system audit logs.
4. The utility presents each logged system call and prompts you to Allow, Deny, or Inherit the requested file capability.
5. Press F to finish and save the generated profile under /etc/apparmor.d/ in enforce mode.

Inspecting and Troubleshooting Denials

When an application behaves unexpectedly due to profile restrictions, inspect recent AppArmor audit messages:

# Search recent kernel denials in real time
sudo dmesg | grep -i apparmor

# Query systemd audit events
sudo journalctl -k --grep="apparmor"

Use sudo aa-logprof to interactively parse audit logs and update your profile definitions safely without breaking operational reliability.