I wanted a quick check to see if my understanding of AppArmor is correct.

  1. AppArmor by default confines only those applications that have profiles defined. Any other application that tries to run will not be blocked by AppArmor.

  2. AppArmor behaves in a "default-deny"/whitelist mode for confined applications: any permission not declared in the profile will be denied during runtime.

  3. AppArmor does not, by default, have a system-wide whitelisting behavior. I did find some info about creating a default profile (https://lists.ubuntu.com/archives/apparmor/2012-December/003241.html), but that looks like it would take some work: you'd have to ensure sufficient permissions are granted for system applications as well, otherwise they wouldn't work properly. But then, you might as well not have this default profile in the first place.

Am I missing something? AppArmor is not intended to provide system-wide process whitelisting capabilities, right?

  • Well you found your own solution it seems... A default profile that matches anything. System wide process whitelisting. – CameronNemo Mar 14 at 4:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.