AppArmor Utils: Managing Security Profiles

Key takeaways

• aa-genprof /usr/sbin/tcpdump generates a profile in learning mode: you exercise the application from a second terminal, then come back and press S (Scan) to analyze the logs, and finally F (Finish) to save.
• When aa-genprof exits, the profile is written to /etc/apparmor.d/ and is put straight into enforce mode: the application is confined immediately.
• aa-logprof is the maintenance tool: it rescans the logs and offers to allow or deny the actions blocked by an existing profile, typically after an application update.
• The profile file name replaces / characters with .: /usr/sbin/tcpdump becomes /etc/apparmor.d/usr.sbin.tcpdump, and that is the path aa-complain, aa-enforce and aa-disable expect.
• A profile has three states: aa-complain logs without blocking (testing), aa-enforce applies the rules strictly (production), aa-disable turns the profile off entirely.

Why Use AppArmor Utils?

• Simplified profile creation: The aa-genprof tool lets you generate a profile in "learning" mode.
• Easy maintenance: aa-logprof analyzes the logs to help you update existing profiles.
• State management: Easily switch a profile from complain mode (logging only) to enforce mode (active blocking).

Prerequisites

• Operating system: A Linux distribution with AppArmor (Ubuntu, Debian, openSUSE...).
• Privileges: Root access or sudo privileges.
• AppArmor: The AppArmor service must be installed and enabled.

Installing AppArmor Utils

The apparmor-utils package is usually installed alongside AppArmor. If not, install it manually:

# On Debian / Ubuntu
sudo apt-get update
sudo apt-get install -y apparmor-utils

Creating a Profile with aa-genprof

This is the main tool for creating a new profile for an application that doesn't have one.

Step 1: Launch the Profile Generator

Suppose you want to confine the tcpdump utility. Run aa-genprof, pointing it to the binary:

sudo aa-genprof /usr/sbin/tcpdump

Step 2: Trigger the Application's Actions

In another terminal, run the application and perform the actions you want to allow. For example:

sudo tcpdump -i eth0 -c 5

Step 3: Scan the Logs and Build the Profile

Go back to the first terminal (the one running aa-genprof) and press the `S` key (Scan). The tool will analyze the system logs looking for events generated by `tcpdump`.

For each event, aa-genprof will ask whether you want to Allow it, Deny it, Ignore it, and so on. Answer the questions to progressively build your profile.

Step 4: Save and Activate the Profile

Once you have handled all the events, press `F` (Finish) to save the profile to /etc/apparmor.d/. The profile will automatically be set to enforce mode.

Updating a Profile with aa-logprof

If a confined application needs new permissions (for example after an update), aa-logprof is the tool you need.

Simply run it:

sudo aa-logprof

Just like aa-genprof, it will scan the logs and offer to allow or deny the actions that were blocked by the existing profile.

Managing Profile Modes

You can easily change a profile's mode.

Switch to complain Mode (Non-Blocking)

sudo aa-complain /etc/apparmor.d/usr.sbin.tcpdump

In this mode, violations are logged but not blocked. This is useful for testing a profile without breaking the application.

Switch to enforce Mode (Blocking)

sudo aa-enforce /etc/apparmor.d/usr.sbin.tcpdump

This is the standard production mode, where the rules are strictly applied.

Disable a Profile

sudo aa-disable /etc/apparmor.d/usr.sbin.tcpdump

Conclusion

The apparmor-utils tools are essential for working efficiently with AppArmor. They turn the potentially complex task of creating and maintaining profiles into an interactive, guided process. Mastering aa-genprof and aa-logprof is the key to securing your Linux applications effectively.