Mandatory Access Control with AppArmor

In this lesson, you will learn how to use AppArmor to enforce strict, granular security policies that dictate exactly which files a container process is allowed to touch.

The Concept of Mandatory Access Control

While namespaces and read-only mounts provide broad isolation, sometimes you need to be more surgical. AppArmor (Application Armor) is a Linux kernel security module that allows the system administrator to associate a security profile with a specific program. Instead of saying "this container cannot write to the root filesystem," you can specify that "this specific process is forbidden from reading /etc/shadow or writing to /var/log," even if the container process is running as root.

How It Works in Containers

When you run a container, Docker automatically applies a default AppArmor profile (often named docker-default). This profile denies access to sensitive host files and prevents dangerous actions like mounting filesystems. You can view the status of profiles on your host by running sudo apparmor_status.

If you have a specialized application that requires even tighter controls, you can create a custom profile. A simple policy looks like a list of rules:

# Profile for a restricted web server
profile restricted-web-server flags=(attach_disconnected, complain) {
  # Deny all access by default
  deny /etc/shadow w,
  deny /etc/passwd w,
  
  # Allow read access to specific config files
  /etc/nginx/nginx.conf r,
  
  # Allow execution of specific binary
  /usr/sbin/nginx ix,
}

To apply this to a container, you would save the profile, load it into the kernel using apparmor_parser -r, and then run your container with the --security-opt flag:

docker run --security-opt "apparmor=restricted-web-server" my-image

By doing this, you are effectively creating a "sandbox within a sandbox." Even if an attacker gains entry to your container process, AppArmor acts as a final gatekeeper, strictly enforcing the path-based permissions defined in your profile. This is a critical layer in defending against container breakouts or local privilege escalation.

Key Takeaway: AppArmor provides Mandatory Access Control by using path-based profiles to restrict specific container processes, ensuring they can only access the files and actions absolutely necessary for their function.