AppArmor

O que é o AppArmor?

AppArmor is a Linux kernel security module that provides mandatory access controls (MAC) to limit what programs can do. Originally developed by Immunix and later acquired by Novell, it has been integrated into the mainline Linux kernel since 2005. It's mature, well-tested, and used by default in Ubuntu and SUSE systems.

It's for system administrators and security-conscious users who want to confine applications to minimize damage from exploits or misbehavior. Unlike antivirus tools like Windows Defender, it doesn't scan files—it enforces policies that define exactly what each program can access. This makes it a proactive layer, not a reactive one.

Compared to Windows Defender Security Center, AppArmor feels more technical and less user-friendly. It doesn't offer a real-time dashboard or pop-up warnings. Instead, it runs silently in the background, enforcing rules you define or that come prepackaged. You won't notice it until something gets blocked—and then you'll need to check logs.

Ideal para: Securing system services and desktop applications on Debian, Ubuntu, and SUSE systems with minimal configuration.

Principais recursos do AppArmor

• Path-based access control for programs
• Per-profile enforcement: disable or complain mode
• Profiles can be generated manually or via learning mode
• Integrated directly into the Linux kernel
• Default profiles included for common services
• Logs denials via syslog or auditd
• Easy to read, human-editable policy syntax

Dicas para quem vem do Windows

Coming from Windows Defender, expect no real-time scanning or automatic threat removal. AppArmor doesn't replace antivirus—it complements it. Instead of file reputation or heuristics, you define rules (profiles) that limit what apps can do. Use 'aa-logprof' to update rules based on denials, and check /var/log/audit/ or dmesg when something breaks. Learn to read AppArmor logs—they're your main feedback.