AppArmor
kernel-featureopen sourceA path-based Linux Security Module where an administrator writes per-application profiles enforced system-wide.
documentedapparmor.net ↗
AppArmor is a mandatory-access-control in which an administrator (root) writes per-application profiles, keyed on filesystem paths, that confine what each program may do. It is one of the default confinement layers container runtimes apply, Docker ships a default AppArmor profile. Unlike Landlock it is privileged and system-wide: policy is set centrally by an admin, not self-imposed by the application.
Strengths
- Per-application MAC profiles, simpler to author than SELinux
- Applied by default in container runtimes as a confinement layer
- Path-based rules are approachable for common cases
Limitations
- Privileged and system-wide, an admin defines policy, not the app
- Path-based model is less comprehensive than SELinux's label model
- Shared kernel, an LSM hardens processes, it is not a VM boundary