What is AppArmor?

A mandatory-access-control system that confines programs to only the files and capabilities they need, limiting blast radius if one is compromised.

How it works

It ships enabled on Ubuntu. Profiles restrict what a process can access, so a compromised browser or service can't read your whole disk. You mostly benefit by leaving it on and not disabling profiles.

Example

In practiceRunning aa-status shows loaded profiles; a confined app can't read your SSH keys even if exploited.

Do I need to configure AppArmor?

Usually no — Ubuntu ships sane defaults. Just don't disable it, and check aa-status to confirm profiles are enforcing.

Go deeper: Build a Hardened Linux Workstation

The complete, step-by-step guide — every command, config, and the reasoning behind it.

Get the guide