AppArmor Profiles and Path-Based Security

In this lesson, you will learn how to create security boundaries for applications using AppArmor profiles to restrict file access based on absolute paths.

While standard permissions (UGO) and ACLs restrict access based on who is asking (the user), AppArmor focuses on what the application is allowed to do regardless of which user executes it. It is a "Mandatory Access Control" system that uses profiles to define exactly which files an application can read, write, or execute.

How Path-Based Security Works

AppArmor profiles are text files stored in /etc/apparmor.d/. When an application starts, AppArmor intercepts its system calls. If the application attempts to touch a file not explicitly permitted in its profile, the kernel denies the request, even if the user running the app has the correct file permissions.

Consider a profile for a simple backup script located at /usr/local/bin/backup.sh. You want to ensure it can only read files in /home/user/data/ and write to /var/backups/:

# Profile for /usr/local/bin/backup.sh
profile backup_script /usr/local/bin/backup.sh {
  # Allow reading files in the data directory
  /home/user/data/* r,
  
  # Allow writing only to the backup directory
  /var/backups/* w,
  
  # Deny everything else by default
}

Modes of Operation

When developing these profiles, you typically use two modes:

1. Complain Mode: AppArmor doesn't block access, but it logs every violation to the system logs (/var/log/syslog). This is how you "learn" what files an application needs to function before locking it down.
2. Enforce Mode: The kernel actively blocks any access not explicitly listed in the profile.

By specifying paths, you create a "sandbox." Even if your application is compromised, the attacker is limited to the specific paths you’ve defined in the profile, preventing them from accessing sensitive system configuration files or other users' data. This path-based restriction is a powerful final layer of defense that operates independently of traditional user-based permissions.

Key Takeaway: AppArmor profiles provide mandatory security by restricting applications to specific filesystem paths, ensuring they can only interact with the files strictly necessary for their function.