0 views
Read
#0
Learn AppArmor - Pre-Requisite Skills & Environment Setup
Before going deeper into AppArmor, there are a few basic Linux skills you must master first: the CLI and shell, systemd service management, user and file permissions, and the concepts of processes, executables, and libraries. This episode guides you through setting up a safe lab environment, installing the userspace tools, and verifying that AppArmor is active.
August 3, 2026
00
Read
#1
Learn AppArmor - History, Background & Why You Need AppArmor
Tracing why the world needs AppArmor: the limits of DAC, which only restricts based on user and group, the birth of AppArmor from the Immunix project, its adoption by Novell and SUSE, its integration into Linux kernel 2.6.36, and its adoption by Docker, containerd, and ChromeOS.
August 3, 2026
00
Read
#2
Learn AppArmor - Basic Concepts & Core Architecture
Understanding the foundations of AppArmor: the concept of per-application profiles that govern file, network, capability, and signal access; the two working modes, enforce and complain; a comparison of AppArmor with SELinux; and the kernel LSM and userspace tools such as apparmor_parser and libapparmor.
August 3, 2026
00
Read
#3
Learn AppArmor - Status, Modes & Load/Unload Profiles
Your first hands-on practice with AppArmor: reading full status with aa-status and checking readiness with aa-enabled, understanding the list of active profiles, switching between enforce and complain modes, and loading and unloading profiles with apparmor_parser, including their persistence across reboots.
August 3, 2026
00
Read
#4
Learn AppArmor - Writing Basic Profiles
The practice of writing your first AppArmor profile: the profile syntax with rules inside curly braces, the r w m k file rules, path globbing for directory patterns, deny rules for explicit access bans, and the use of the includes and abstractions shipped by your distro.
August 3, 2026
00
Read
#5
Learn AppArmor - Profile Tools: aa-genprof & aa-logprof
Boosting productivity with AppArmor's interactive tools: creating a new profile with aa-genprof directly from a target executable, allowing and denying each request that appears, updating a profile from denial logs with aa-logprof, and verifying the final result.
August 3, 2026
00
Read
#6
Learn AppArmor - Network & Capabilities Rules
Restricting processes through two dimensions beyond the filesystem: network rules for controlling TCP, UDP, Unix, and netlink sockets, capability rules for special kernel privileges, and the least privilege principle that unites them.
August 3, 2026
00
Read
#7
Learn AppArmor - Debugging Denials & Logs
Reading AppArmor denial traces in syslog and journald, understanding the apparmor DENIED format, running the observe-adjust-reload-verify debug loop, and using aa-notify for real-time denial notifications.
August 3, 2026
00
Read
#8
Learn AppArmor - Variables, Tunables & Includes
Making profiles portable with built-in variables for the home directory and procfs, understanding the tunables directory, and leveraging built-in and custom abstractions to write shared rules once and reuse them across many profiles.
August 3, 2026
00
Read
#9
Learn AppArmor - Web & Application Services
Applying AppArmor to real services: the built-in profiles for Nginx, Apache, and OpenSSH, customizing web roots and SSL certificates, MySQL and PostgreSQL database profiles, Node and Python runtimes, and the log rotation traps.
August 3, 2026
00