apparmor (advanced)

Manage AppArmor mandatory access control profiles.

medium risk

interactive breakdown — edit the command and press Explain
$ 
⚠ Risks & cautions
What it does

AppArmor confines processes to defined sets of files, capabilities, and network access using profiles. Default on Ubuntu/Debian. Profiles are stored in /etc/apparmor.d/. aa-status shows which processes are confined, aa-complain sets a profile to log-only mode for debugging.

Examples
aa-statusShow all AppArmor profiles and their modes · explain & risk-check →
aa-complain /etc/apparmor.d/usr.sbin.nginxSet nginx profile to complain/log mode for debugging · explain & risk-check →
aa-enforce /etc/apparmor.d/usr.sbin.nginxSet nginx profile back to enforce mode · explain & risk-check →
apparmor_parser -r /etc/apparmor.d/usr.sbin.nginxReload a modified AppArmor profile · explain & risk-check →
dmesg | grep apparmorView AppArmor kernel messages and denials · explain & risk-check →
Pro tip

Use `aa-complain` on a problematic profile, reproduce the issue, then check `dmesg | grep apparmor` to see exactly what was denied — build the policy fix from real denials, not guessing.

Related
selinux journalctl chmod
Open the full explainer →More in Users, Permissions & Security

Reference text is hand-written and may be incomplete — check man apparmor for your version. Test destructive commands on a non-production system first.