← All tech

AppArmor

kernel-featureopen source

A path-based Linux Security Module where an administrator writes per-application profiles enforced system-wide.

AppArmor is a mandatory-access-control in which an administrator (root) writes per-application profiles, keyed on filesystem paths, that confine what each program may do. It is one of the default confinement layers container runtimes apply, Docker ships a default AppArmor profile. Unlike Landlock it is privileged and system-wide: policy is set centrally by an admin, not self-imposed by the application.

Strengths

  • Per-application MAC profiles, simpler to author than SELinux
  • Applied by default in container runtimes as a confinement layer
  • Path-based rules are approachable for common cases

Limitations

  • Privileged and system-wide, an admin defines policy, not the app
  • Path-based model is less comprehensive than SELinux's label model
  • Shared kernel, an LSM hardens processes, it is not a VM boundary

Sources