{{short description|Linux kernel security module}}{{Use dmy dates|date=February 2025}}{{Infobox software | name = AppArmor | logo = AppArmor logo.svg | screenshot = | caption = | author = Immunix | developer = Originally by Immunix (1998-2005), then by SUSE as part of Novell (2005-2009), and currently by Canonical Ltd (since 2009). | released = {{Start date and age|1998}} | latest release version = {{wikidata|property|preferred|references|edit|Q620616|P348}} | latest release date = {{start date and age|{{wikidata|qualifier|preferred|single|Q620616|P348|P577}}}} | repo = {{URL|https://gitlab.com/apparmor}} | programming language = C, Python, C++, sh<ref>[https://www.openhub.net/p/apparmor/analyses/latest/languages_summary The AppArmor: Application Armor Open Source Project on Open Hub: Languages Page]</ref> | operating system = Linux | platform = | language = | genre = Security, Linux Security Modules (LSM) | license = GNU General Public License | website = {{URL|https://apparmor.net}} }}

'''AppArmor''' ("Application Armor") is a Linux kernel security module that allows the system administrator to restrict programs' capabilities with per-program profiles. Profiles can allow capabilities like network access, raw socket access, and the permission to read, write, or execute files on matching paths. AppArmor supplements the traditional Unix discretionary access control (DAC) model by providing mandatory access control (MAC). It has been partially included in the mainline Linux kernel since version 2.6.36 and its development has been supported by Canonical since 2009.

==Details== In addition to manually creating profiles, AppArmor includes a learning mode, in which profile violations are logged, but not prevented. This log can then be used for generating an AppArmor profile, based on the program's typical behavior.

AppArmor is implemented using the Linux Security Modules (LSM) kernel interface.

AppArmor is offered in part as an alternative to SELinux, which critics consider difficult for administrators to set up and maintain.<ref>{{cite web | url = https://www.linux.com/training-tutorials/selinux-comprehensive-security-price-usability/ | title = SELinux: Comprehensive security at the price of usability | author = Mayank Sharma | date = 2006-12-11 | access-date = 2023-06-11 }}</ref> Unlike SELinux, which is based on applying labels to files, AppArmor works with file paths. Proponents of AppArmor claim that it is less complex and easier for the average user to learn than SELinux.<ref>{{cite web | title = Protective armor: Shutting out intruders with AppArmor | author = Ralf Spenneberg | url = https://www.linux-magazine.com/issues/2006/69/protective_armor | date = August 2006 | access-date = 2008-08-02 | publisher = Linux Magazine | archive-url = https://web.archive.org/web/20080821103924/http://linux-magazine.com/issues/2006/69/protective_armor | archive-date = 21 August 2008 | url-status = live}}</ref> They also claim that AppArmor requires fewer modifications to work with existing systems.{{Citation needed|date=October 2007}} For example, SELinux requires a filesystem that supports "security labels", and thus cannot provide access control for files mounted via NFS. AppArmor is filesystem-agnostic.

== History == AppArmor was first used in Immunix Linux 1998–2003. At the time, AppArmor was known as SubDomain,<ref>{{cite web|url=http://www.techrepublic.com/article/immunix-system-7-linux-security-with-a-hard-hat-not-a-red-hat/1053405 |title=Immunix System 7: Linux security with a hard hat (not a Red Hat) |author=Vincent Danen |date=2001-12-17 |url-status=dead |archive-url=https://web.archive.org/web/20120523181535/http://www.techrepublic.com/article/immunix-system-7-linux-security-with-a-hard-hat-not-a-red-hat/1053405 |archive-date=May 23, 2012}}</ref><ref>{{cite web | url = http://www.immunix.org/ | title = Immunix.org: The Source for Secure Linux Components and Platforms | author = WireX Communications, Inc. | date = 2000-11-15 | archive-url = https://web.archive.org/web/20010203215300/http://www.immunix.org/ | archive-date = 2001-02-03}}</ref> a reference to the ability for a security profile for a specific program to be segmented into different domains, which the program can switch between dynamically. AppArmor was first made available in SLES and openSUSE and was first enabled by default in SLES 10 and in openSUSE 10.1.

In May 2005 Novell acquired Immunix and rebranded SubDomain as AppArmor and began code cleaning and rewriting for the inclusion in the Linux kernel.<ref>{{cite web|url=https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_History|title=AppArmor_History · Wiki · AppArmor / apparmor}}</ref> From 2005 to September 2007, AppArmor was maintained by Novell. SUSE is now the legal owner of the trademarked name AppArmor.<ref>{{US trademark|78876817}}</ref> openSUSE Tumbleweed transitioned from AppArmor to SELinux for new installation since 11 February 2025, openSUSE Leap 16 switched to SELinux by default as well.<ref>{{Cite web |last=Gompa |first=Neal |date=2025-02-13 |title=Re: Announcement: SELinux as default MAC system on new Tumbleweed installations - openSUSE Factory |url=https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/message/3JUSAOAXUWDXG4BSU3CEKY4Z3QUMI2US/ |access-date=2025-02-14 |website=openSUSE Mailing Lists |language=en}}</ref> AppArmor is still available as install-time selection for users who prefer it.<ref>{{Cite web |last=DeMaio |first=Douglas |date=2025-02-13 |title=Tumbleweed Adopts SELinux as Default |url=https://news.opensuse.org/2025/02/13/tw-plans-to-adopt-selinux-as-default/ |access-date=2025-02-13 |website=openSUSE News |language=en}}</ref>

AppArmor was first successfully ported/packaged for Ubuntu in April 2007. AppArmor became a default package starting in Ubuntu 7.10. In Ubuntu 8.04 it protected only CUPS by default. As of Ubuntu 9.04 more items such as MySQL had installed profiles. AppArmor hardening continued to improve in Ubuntu 9.10 with profiles for its guest session, libvirt virtual machines, Evince (document viewer), and an optional Firefox profile.<ref>{{cite web|url=https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/AppArmorProfiles|title=SecurityTeam/KnowledgeBase/AppArmorProfiles – Ubuntu Wiki|access-date=9 January 2011}}</ref>

AppArmor was integrated into the October 2010, 2.6.36 kernel release.<ref>{{cite web | url = https://lwn.net/Articles/409810 | title = The 2.6.36 kernel is out | author = James Corbet | date = 2010-10-20}}</ref><ref>{{cite web | url = http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36 | title = Change Log | author = Linus Torvalds | date = 2010-10-20 | url-status = dead | archive-url = https://web.archive.org/web/20110904032047/http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36 | archive-date = 2011-09-04}}</ref><ref>{{cite web | url = https://kernelnewbies.org/Linux_2_6_36 | title = Linux 2.6.36 | date = 2010-10-20}}</ref><ref>{{cite web | url = http://www.linuxplanet.com/linuxplanet/reports/7203/1/ | title = Linux Kernel 2.6.36 Gets AppArmor | author = Sean Michael Kerner | date = 2010-10-20 | access-date = 2010-10-21 | archive-date = 2018-02-03 | archive-url = https://web.archive.org/web/20180203064922/http://www.linuxplanet.com/linuxplanet/reports/7203/1/ | url-status = dead }}</ref>

AppArmor has been integrated to Synology's DSM since 5.1 Beta in 2014.<ref>{{cite web | url = https://www.synology.com/de-de/support/beta_dsm_5_1 | archive-url = https://archive.today/20141021080732/https://www.synology.com/de-de/support/beta_dsm_5_1 | url-status = dead | archive-date = October 21, 2014 | title = Release Notes for DSM 5.1 Beta Program }}</ref>

AppArmor was enabled in Solus Release 3 on 2017/8/15.<ref>{{cite web | url = https://www.phoronix.com/scan.php?page=news_item&px=Solus-3-Released | title = Solus 3 Linux Distribution Released For Enthusiasts}}</ref>

AppArmor is enabled by default in Debian 10 (Buster), released in July 2019.<ref>{{cite web | title = New in Buster | url = https://wiki.debian.org/NewInBuster}}</ref>

== Other systems == AppArmor represents one of several possible approaches to the problem of restricting the actions that installed software may take.

The SELinux system generally takes an approach similar to AppArmor. One important difference: SELinux identifies file system objects by inode number instead of path. Under AppArmor an inaccessible file may become accessible if a hard link to it is created. This difference may be less important than it once was, as Ubuntu 10.10 and later mitigate this with a security module called Yama, which is also used in other distributions.<ref>{{Cite web|title=Security/Features - Ubuntu Wiki|url=https://wiki.ubuntu.com/Security/Features|access-date=2020-07-19|website=wiki.ubuntu.com}}</ref> SELinux's inode-based model has always inherently denied access through newly created hard links because the hard link would be pointing to an inaccessible inode.

SELinux and AppArmor also differ significantly in how they are administered and how they integrate into the system.

Isolation of processes can also be accomplished by mechanisms like virtualization.

In 2007, the Simplified Mandatory Access Control Kernel was introduced.

In 2009, a new solution called Tomoyo was included in Linux 2.6.30; like AppArmor, it also uses path-based access control.

==See also== {{Portal|Free and open-source software}} * Security-Enhanced Linux * Systrace

==References== {{Reflist|30em}}

==External links== * [https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor Wiki] * [https://wiki.ubuntu.com/AppArmor AppArmor - Ubuntu Wiki] * [https://en.opensuse.org/SDB:AppArmor SDB:AppArmor - openSUSE Wiki] * [https://wiki.archlinux.org/title/AppArmor AppArmor - ArchWiki] * [https://web.archive.org/web/20071229102813if_/http://www.linux-magazine.com/issues/2006/69/counterpoint COUNTERPOINT - Novell and Red Hat security experts face off on AppArmor and SELinux] * [https://documentation.suse.com/sles/15-SP2/html/SLES-all/part-apparmor.html SLES 15 SP2 | Security and Hardening Guide | Confining Privileges with AppArmor] * [https://lkml.org/lkml/2006/4/19/199 LKML: Tony Jones: &#91;RFC&#93;&#91;PATCH 0/11&#93; security: AppArmor - Overview]

{{Linux kernel}}

Category:Linux kernel features Category:Linux security software