AppArmor is a Linux Security Module that limits what applications can do, on top of normal file permissions. It is installed and loaded by default on Ubuntu. Complain mode logs violations and allows them. Enforce mode blocks and logs them. Use complain mode when you are testing a profile.
What it is
Ubuntu's documentation says AppArmor adds mandatory access control on top of standard file permissions. Each program can have a profile defining what it may access. Profiles are text files in /etc/apparmor.d, named after the executable's path with slashes replaced by dots. For example, /etc/apparmor.d/bin.ping covers /bin/ping.
Profiles contain path entries, which control file access, and capability entries, which control privileges a confined process can use.
Check what is running
sudo aa-status
This shows loaded profiles and how many are in enforce mode. Run it once on a new machine so you know your baseline.
Complain versus enforce
Complain mode. Policy violations are allowed but logged. It is for testing and for building new profiles.
Enforce mode. Violations are blocked and also logged.
Switch a program between them:
sudo aa-complain /path/to/bin
sudo aa-enforce /path/to/bin
After you edit a profile, reload it:
sudo apparmor_parser -r /etc/apparmor.d/profile.name
Why developers meet it
Something works as root or on another machine and fails on your laptop with a permission error that file modes cannot explain. A confined program trying to read a path outside its profile is a common cause. The log will show the denial.
Where you fix it matters.
- Confirm that AppArmor is the cause by putting that one profile in complain mode and retrying.
- If it works, read the logged denials.
- Add only the rule the program legitimately needs.
- Return the profile to enforce mode.
- Keep your change under version control or in your configuration management.
Do not disable AppArmor globally to get past one denial. The documentation does not recommend that, and you would lose protection for every confined program.
Custom tools
For your own tools, a profile is optional work. You can start in complain mode, run the tool through its normal paths, and use the logs to build a profile. That is what complain mode is for.
The page used here does not cover the profile-generation tools in detail, so check Ubuntu's documentation for the current workflow.
Limits
AppArmor confines individual programs. It does not stop a user from running a malicious script they chose to run, and it does not check the libraries in your projects. A scan of those dependencies is separate. Safeguard's free scan at gold.safeguard.sh/scan works on a repository.
Quick check
Does complain mode block anything?
No. Ubuntu says violations are allowed but logged in complain mode.
How do I reload a profile after editing it?
Run sudo apparmor_parser -r with the path to the profile file under /etc/apparmor.d.
Sources
Last reviewed: 19 October 2026.
