Is there a way to create an AppArmor profile for each Firefox profile, when running multiple profiles off a single installation of Firefox? Or more generally for any application supporting multiple profiles, Thunderbird, etc. Generally all the AppArmor profiles I find for these apps only contain the whole app, unless I missed something.

Usually you launch a Firefox or Thunderbird with a command line argument to specify a different profile. However I can find nothing in the AppArmor profile syntax to match against app arguments.

I know libvirt does this somehow by creating an AppArmor profile for each virtual machine, so there must be some way.


4 Answers 4


AppArmor works by executable. It can't figure out that Firefox has loaded a different profile and so it should use a different AppArmor profile.

AppArmor does support change rules, which allow an application to change which profile applies to it. The intended use case is precisely to allow an application to switch to a more restrictive profile once it's finished initializing and figured out what it needs to access in this particular instance. So if Firefox was AppArmor-aware, it would be possible to give it change_profile rule and have it apply the transition once it's figured out which profile to run as. As far as I know, this hasn't been done.

What you can do without programming is make multiple copies or hard links of the firefox-bin executable, and define different profiles for each of them (AppArmor is based on the path to the executable, so different hard links need not use the same profile, unlike SELinux which is based on inodes). This requires root and isn't so convenient, which is why the change profile feature was added to AppArmor.

  • Hard links! So simple I couldn't think of it. I'll have to try that, thanks, though not ideal. Commented Jun 21, 2015 at 4:57
  • One drawback is that you have to recreate hard links on each update (automate it). Isn't it better to just create shell scripts with one line exec firefox "$@" instead of hard links? Also adding a line /usr/bin/firefox ix, to the script profile, so that firefox can inherit the profile.
    – Alek
    Commented Mar 13, 2022 at 16:24

I'm not sure, but as I understand, I think: no.

Apparmor could make distinction between different

  • application
  • file-system path
  • user / group

For having different apparmor behaviour against different application profile, you have to create different users for each apparmor behaviour.

Like android do for sandboxing all apps under different ``user''.

  • Actually AppArmor does support this (with reasonably recent versions), through change rules, but only with the cooperation of the application. Commented Jun 14, 2015 at 17:29
  • Thanks... I was hoping to avoid further containment such as by user, but I can recognize it's also the traditional pattern for this... Commented Jun 21, 2015 at 4:54

It is possible either with a local profile, either with an unattached profile, either with a namespace.

A local profile is defined with

profile /usr/bin/firefox//some-name {

An unattached profile is defined with

profile Some.name {

A namespaced profile is defined with

profile :some-namespace:/usr/bin/firefox {

Attributing a non-standard profile to a process can be achieved either by the process itself with change_profile (as already answered) either with the help of systemd (property AppArmorProfile= to be defined in a service unit).


Very easy, my friend. Create a hard-link called firefox-(putProfileNameHere):

cd /data/usr/lib/firefox/
sudo ln firefox /usr/bin/firefox-default
sudo ln firefox /usr/bin/firefox-1b58iygj
#etc etc etc

Create multiple App Armor profiles:

cd /etc/apparmor.d
cp usr.bin.firefox usr.bin.firefox-default
cp usr.bin.firefox usr.bin.firefox-1b58iygj
#etc etc etc

Modify each profile as you wish.

Create different .desktop files in /usr//share/applications (or use a Menu manager like Alacarte or KDE ??) to launch the custom binaries + relevant profile:

firefox-1b58iygj --profile /home/<yourUserID>/.mozilla/firefox/1b58iygj
#etc etc etc

Have fun.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .