AppArmor

A Linux kernel security module that confines programs to the actions allowed in per-application profiles.

FreeProprietaryLinuxCommand line
Official websiteapparmor.netDownload pageapparmor.netSource codegitlab.com

These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.

About AppArmor

AppArmor adds mandatory access control to Linux on top of the usual Unix permissions. Each confined program gets a profile listing what it may do, covering file access, Linux capabilities, network sockets, DBus messages and inter-process communication. The kernel enforces the policy, so a compromised application cannot change or bypass it.

It has been part of the mainline kernel since 2.6.36, with development supported by Canonical since 2009. It suits administrators who want to limit the damage a vulnerable service could do.

Strengths

  • Enforced by the kernel, not by the confined program
  • Per-application profiles covering files, network, capabilities and DBus
  • Included in the mainline Linux kernel
  • Official documentation on writing and troubleshooting profiles

Limitations

  • Linux only
  • Writing and tuning profiles takes time and testing

Details

Pricing
FreeFree and included in the mainline Linux kernel.
License
Proprietary
Developer
The AppArmor contributors
Platforms
Linux, Command line
How it runs
Downloadable app
Account
Not required
Works offline
Yes
Best suited for
Linux administrators confining services and applications
Categories
Security tools
Last verified
Added
Provenance
Facts checked against the developer's own pages and store listings, 1 sources on file.

Alternatives to AppArmor

Compare all

Software that can replace AppArmor for an important use case, and what changes if you switch.

  • SELinux

    The userland libraries and tools for Security Enhanced Linux, the kernel's mandatory access control system.

    FreeOpen sourceLinuxCommand line

    SELinux provides kernel-enforced mandatory access control through labelled policy instead of per-application path profiles, with a complete toolset but a steeper learning curve for writing policy.

  • Firejail

    A SUID sandbox program that restricts Linux applications using kernel namespaces and seccomp-bpf.

    FreeOpen sourceLinuxCommand line

    Firejail sandboxes existing Linux applications using kernel namespaces and seccomp-bpf, running as a SUID program rather than a kernel security module.

  • Bubblewrap

    A low-level Linux command-line tool that runs programs in unprivileged sandboxes, used by Flatpak.

    FreeOpen sourceLinuxCommand line

    Bubblewrap runs programs in unprivileged sandboxes on Linux and underlies Flatpak, controlled from scripts rather than per-application profiles.

  • gVisor

    An application kernel that sandboxes containers to isolate them from the host Linux kernel.

    FreeOpen sourceLinuxCommand line

    gVisor sandboxes containers with an application kernel for stronger isolation, focused on running untrusted code rather than confining desktop services.

Similar software

Related functionality, not necessarily a direct replacement.

Report a wrong fact or a dead link on this listing