I wanted a quick check to see if my understanding of AppArmor is correct.
AppArmor by default confines only those applications that have profiles defined. Any other application that tries to run will not be blocked by AppArmor.
AppArmor behaves in a "default-deny"/whitelist mode for confined applications: any permission not declared in the profile will be denied during runtime.
AppArmor does not, by default, have a system-wide whitelisting behavior. I did find some info about creating a default profile (https://lists.ubuntu.com/archives/apparmor/2012-December/003241.html), but that looks like it would take some work: you'd have to ensure sufficient permissions are granted for system applications as well, otherwise they wouldn't work properly. But then, you might as well not have this default profile in the first place.
Am I missing something? AppArmor is not intended to provide system-wide process whitelisting capabilities, right?