What it does
AppArmor is a Linux mandatory-access-control system that confines applications through profiles defining allowed operations.
AppArmor profiles can govern filesystem access, capabilities, sockets and other application interactions. Its documentation explains that denied operations are logged, giving an administrator evidence for reviewing a profile. Use complain mode to investigate a missing rule before changing enforcement. That mode observes without blocking, so it has a different security effect. Keep the profile tied to the application role and review broad exceptions rather than allowing every operation needed to silence a log.
Strengths
- Per-application access profiles with denial logs
Best for
- Linux administrators maintaining application confinement
Sources
- AppArmor Documentation - AppArmor (Oct 26, 2026)