The Path-Based Logic of AppArmor

In this lesson, you will learn how AppArmor uses human-readable file paths to define security boundaries, making it an intuitive approach to Mandatory Access Control (MAC).

Understanding Path-Based Enforcement

Unlike systems that rely on complex, hidden security labels (like SELinux), AppArmor focuses on the file system hierarchy. It operates by intercepting system calls and asking a simple question: "Is the application allowed to perform this action on this specific file path?"

Because AppArmor ties security rules directly to the path string (e.g., /etc/nginx/nginx.conf), it aligns perfectly with how administrators already think about the Linux directory structure. When a process attempts to open() a file, the AppArmor module evaluates the path against the loaded profile. If the path isn't explicitly granted access, the kernel denies the request by default.

A Practical Illustration

Consider a web server that should only serve content from /var/www/html/ and read its configuration from /etc/nginx/. You can define a profile that explicitly lists these paths:

profile nginx /usr/sbin/nginx {
  /usr/sbin/nginx rmix,
  /etc/nginx/** r,
  /var/www/html/** r,
  /var/log/nginx/* w,
}

In this block:

• /etc/nginx/** uses a double-asterisk glob, meaning the application can read any file within that directory and its subdirectories.
• /var/log/nginx/* allows the application to write to files (logs) directly in that directory, but not in deeper sub-directories.
• The rmix flags stand for read, memory-map, inherit, and execute.

If the Nginx process tries to access a sensitive file like /etc/shadow, AppArmor sees that the path is not covered by the profile and blocks the action immediately, regardless of the user ID running the process.

This simplicity is both a strength and a challenge: while it makes management easier for human admins, you must ensure that your path definitions cover all necessary file operations. If a path is renamed or moved, you must update the profile to reflect the new location, as the security logic is bound to the physical file system hierarchy rather than the file itself.

Key Takeaway: AppArmor enforces security by mapping process permissions directly to file system paths, providing a transparent and human-readable way to restrict application behavior.