What are all the ways AppArmor profiles can be matched to processes? One seems to be path based (e.g. the /sbin/dhclient profile is applied when /sbin/dhclient is executed) but is this due to /sbin/dhclient appearing in the sbin.dhclient profile or because of the way sbin.dhclient is named?

Also, for non-path based profile matching (e.g. for the docker-default profile) how is AppArmor told which processes to apply the profile to?

1 Answer 1


AppArmor profiles using a mangled path of the command for the filename is just a convention. From man 7 apparmor:

Profiles are traditionally stored in files in /etc/apparmor.d/ under filenames with the convention of replacing the / in pathnames with . (except for the root /) so profiles are easier to manage (e.g. the /usr/sbin/nscd profile would be named usr.sbin.nscd).

The profile name, if it contains a file glob, applies to files matched by that glob. From the AppArmor Core Policy Reference:

The attachment specification is used by AppArmor to determine which executables a profile will attach to. If alternate profile name is not supplied the attachment specification is also used as the profiles name and if an attachment specification is not specified a profile name must be provided.

The name of a profile is very import in AppArmor. It provides not only a name(s) that users can associate to the set of profile rules, but is also used for labeling, ipc, and in the case that the name is an attachment specification it determines to which executables the profile attaches.

  • what about the docker-default profile or other non-path based profile names?
    – dippynark
    Nov 19, 2018 at 17:08
  • What about them?
    – muru
    Nov 19, 2018 at 23:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .