How to Configure AppArmor Profiles in Audit and Complain Mode on Ubuntu

Mandatory Access Control (MAC) frameworks provide essential protection against zero-day application exploits by confining processes strictly to declared file paths, network sockets, and capabilities. While Ubuntu enforces AppArmor out of the box, immediately placing custom microservices or modified daemon profiles into strict enforce mode risks service outages if legitimate file accesses are abruptly blocked. Configuring AppArmor profiles in audit and complain mode enables administrators to profile real-world execution paths, generate comprehensive violation ledgers, and refine security profiles safely before enforcing confinement.

Understanding AppArmor Operational Modes

In Ubuntu, an AppArmor profile operates in one of three distinct behavioral states:

• Enforce Mode: Security policies are actively enforced. Any access attempt not explicitly declared in the profile is blocked immediately and logged as an AppArmor DENIED kernel event.
• Complain Mode: Security policies are evaluated against process actions, but violations are permitted rather than blocked. Accesses that would normally fail in enforce mode generate AUDIT log entries while allowing the process to continue running uninhibited.
• Audit Mode: Can be applied globally or per-rule to log all security accesses (both permitted and refused), providing full accounting during compliance audits.

Installing AppArmor User Utilities

Management commands such as aa-status, aa-complain, and aa-logprof reside in the apparmor-utils package. Ensure these administrative tools are installed:

sudo apt update
sudo apt install apparmor-utils apparmor-profiles -y

Inspect currently loaded profiles and their operational states:

sudo aa-status

The summary report displays the number of profiles loaded into the Linux kernel alongside specific counts of processes confined in enforce mode versus complain mode.

Switching Profiles to Complain and Audit Mode

To safely troubleshoot or profile a service (such as Nginx, MySQL, or a custom daemon) without disrupting live user traffic:

1. Identify the target profile located in /etc/apparmor.d/ (e.g., /etc/apparmor.d/usr.sbin.nginx).
2. Switch the profile from enforce mode to complain mode:

   sudo aa-complain /usr/sbin/nginx

3. Verify the status update:

   sudo aa-status | grep nginx

4. To explicitly enable audit logging for every single policy match (including permitted operations), append the audit flag to the profile declaration or run:

   sudo aa-audit /usr/sbin/nginx

Analyzing Audit Logs and Refining Profiles with aa-logprof

While complain mode is active, simulate realistic production workloads across your application. AppArmor streams diagnostic audit records directly to the kernel audit log:

sudo journalctl -k --grep="apparmor"

Rather than manually writing complex regex paths into policy text files, run the automated profile optimization tool:

sudo aa-logprof

The aa-logprof interactive utility scans /var/log/audit/audit.log (or systemd journald), displays observed access paths, and prompts administrators to allow, deny, or glob file capabilities into the profile cleanly.

Transitioning Back to Strict Enforce Mode

Once profiling finishes and all required access paths are recorded, switch the profile back into strict enforcement mode to lock down the application boundary:

sudo aa-enforce /usr/sbin/nginx
sudo systemctl reload apparmor

Utilizing complain mode bridges the gap between development agility and production security hardening across Ubuntu enterprise environments.