Alternatives to AppArmor
A Linux kernel security module that confines programs to the actions allowed in per-application profiles. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
AppArmor
A Linux kernel security module that confines programs to the actions allowed in per-application profiles.
Replacements
Listings that take over the same core job as AppArmor.
SELinux
The userland libraries and tools for Security Enhanced Linux, the kernel's mandatory access control system.
SELinux provides kernel-enforced mandatory access control through labelled policy instead of per-application path profiles, with a complete toolset but a steeper learning curve for writing policy.
Firejail
A SUID sandbox program that restricts Linux applications using kernel namespaces and seccomp-bpf.
Firejail sandboxes existing Linux applications using kernel namespaces and seccomp-bpf, running as a SUID program rather than a kernel security module.
Bubblewrap
A low-level Linux command-line tool that runs programs in unprivileged sandboxes, used by Flatpak.
Bubblewrap runs programs in unprivileged sandboxes on Linux and underlies Flatpak, controlled from scripts rather than per-application profiles.
gVisor
An application kernel that sandboxes containers to isolate them from the host Linux kernel.
gVisor sandboxes containers with an application kernel for stronger isolation, focused on running untrusted code rather than confining desktop services.
Similar software
Related functionality, not a direct replacement.
Tetragon
An eBPF-based security observability and runtime enforcement tool for Linux hosts and Kubernetes clusters.
USBGuard
A Linux framework that allows or blocks USB devices according to rules you write.
Flatseal
A graphical utility for reviewing and changing the permissions of installed Flatpak applications.
