AppArmor is a mandatory access control (MAC) system that confines individual programs to a set of allowed files, capabilities and operations defined in a profile. Its presence and mode change what a compromised or abused process can actually do.
What is AppArmor?#
Where standard permissions are discretionary (owners decide), AppArmor is mandatory: the policy is enforced regardless of file ownership. Profiles run in enforce mode (blocked) or complain mode (logged only). Ubuntu ships AppArmor by default.
Why LinPEAS checks apparmor#
LinPEAS reports enabled protections including AppArmor because they affect the escalation surface. A binary you might abuse could be confined; conversely, a profile in complain mode enforces nothing.
What a normal configuration looks like#
AppArmor is enabled with key services (browsers, container runtimes, network daemons) confined in enforce mode.
Why it can be security-sensitive#
Profiles in complain mode, disabled profiles, or a disabled AppArmor subsystem remove a layer of containment. This doesn't create a vulnerability by itself, but it can make an otherwise-contained abuse viable.
Understanding the concept tells you whether a LinPEAS highlight is a real problem here. The tool flags candidates; you confirm exploitability in context, and only act where authorised.
How to check it manually#
Run these read-only commands to inspect this area yourself and validate what LinPEAS reports:
aa-status 2>/dev/null; cat /sys/module/apparmor/parameters/enabled 2>/dev/nullcat /sys/kernel/security/apparmor/profiles 2>/dev/nullDefensive remediation#
- Keep AppArmor enabled and profiles in enforce mode.
- Confine network-facing and privileged services with tested profiles.
- Investigate profiles left in complain mode.
Sources & references
- HackTricks: Linux privilege escalation
- GTFOBins — abuse techniques for standard binaries
- PEASS-ng repository — reviewed 20260908-dffb9496