In this lesson, you will learn how to leverage AppArmor’s automated discovery tools to generate a foundational security profile for a new application.
Writing a granular security profile from scratch is error-prone and tedious. Instead of guessing which files or network sockets your application needs, you should use the aa-genprof utility. This tool puts your application into "complain mode," where AppArmor observes the application’s behavior and logs every system call it makes without actually blocking anything.
The Workflow: Observation to Enforcement
To begin, install the apparmor-utils package and run the generator against your executable:
sudo aa-genprof /usr/bin/your-app
Once running, interact with your application normally. Perform every task the app is expected to do—read config files, write logs, connect to a database, or listen on a port. As you perform these actions, aa-genprof monitors the audit logs. If the app tries to access a path it hasn't seen before, the utility will pause and ask you how to handle it:
- Allow: Add a specific rule to the profile.
- Glob: Add a wildcard rule (e.g., allow access to all files in
/var/log/myapp/*.log). - Deny: Reject the access attempt.
After you have exercised all the app’s features, press S to save the profile. AppArmor will then write the configuration to /etc/apparmor.d/. At this point, you can switch the profile into "enforce mode" using aa-enforce /usr/bin/your-app.
Why Baseline with Discovery?
Using automated discovery prevents "policy drift" and ensures your baseline is based on the actual runtime requirements of the software rather than assumptions. It creates a "least privilege" starting point that you can manually tune later if your security posture requires stricter constraints. Because you observed the application in a production-like flow, your baseline is functional, immediately deployable, and significantly more robust than a manually authored profile.
Key Takeaway: Use aa-genprof to observe real-world application behavior in complain mode, allowing you to build an accurate, least-privilege baseline profile before transitioning to strict enforcement.