Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know the AppArmor profiles resides in /etc/apparmor.d/, but I do not know how to interpret it. Any translation would be enlightening.

share|improve this question
You mean the configuration from /etc/apparmor.d/usr.bin.firefox? It looks very explanatory. – Lekensteyn May 9 '11 at 13:13
@Lekensteyn, no I do not know how to read it. And sorry about the new question, I posted it mistakenly after I couldn't find my own question. – Oxwivi Jun 27 '11 at 18:56
It would be better if you had studied the syntax and then asked some more specific questions. There's plenty of documentation online. You can't expect anyone to explain the profile line by line. – arrange Jun 28 '11 at 8:10
@arrange, I was hoping someone would. :) You can't expect every user to learn to effects when considering using it. – Oxwivi Jun 28 '11 at 8:16
@Oxwivi: I get your point, but right now there are 618 lines in FF-related apparmor profile files... – arrange Jun 28 '11 at 8:28
up vote 3 down vote accepted

The only thing confusing in there are the codes and your interpret them like this:

'r'  read
'w'  write
'm'  memory map as executable
'k'  file locking
'l'  creation hard links
'ix' execute and inherit this profile
'Px' execute under another profile, after cleaning the environment
'Ux' execute unconfined, after cleaning the environment

The rest of the file are mainly directories, files and libraries with sometimes some parameters in front (like PROC and HOME which seem easy to understand) and regexes to make it more flexible and sometimes a 'deny' or 'owner' in front of the line (these seem to be self-explanatory to me: they deny access and limit actions in case it is the owner doing them).

Regarding PROC:


# for networking
  network inet stream,
  network inet6 stream,
  @{PROC}/[0-9]*/net/if_inet6 r,
  @{PROC}/[0-9]*/net/ipv6_route r,

and do

cd /proc/
ls *

See all the directories with digits? These correspond to each running process. If any of them contain a directory net (network) and that holds a file if_net6 or ipv6_route they are considered read.

share|improve this answer
HOME I understand, but not PROC. – Oxwivi Jun 28 '11 at 7:26
Also there are some lines without any of the parameters defined. – Oxwivi Jun 28 '11 at 7:37
so the code behind it says what permission it gets systemwide for every user. – Rinzwind Jun 28 '11 at 7:44

See Access Modes, Rule Qualifiers, and #include mechanism in the man page...

man apparmor.d

The man page explains it pretty verbosely. Regarding your question about @{PROC} there are variables which can be set within include files. From the apparmor.d(5) man page...

Some of the abstractions rely on variables that are set in files in the /etc/apparmor.d/tunables/ directory. These variables are currently @{HOME} and @{HOMEDIRS}. Variables cannot be set in profile scope; they can only be set before the profile. Therefore, any profiles that use abstractions should either #include <tunables/global> or otherwise ensure that @{HOME} and @{HOMEDIRS} are set before starting the profile definition. The aa-autodep(8) and aa-genprof(8) utilities will automatically emit #include <tunables/global> in generated profiles.

If you look in /etc/apparmor.d/tunables/global you'll see there's another #include <tunables/proc>. The contents of that file is....

# Copyright (C) 2006 Novell/SUSE... GNU GPLv2... more license info...
# @{PROC} is the location where procfs is mounted.

So @{PROC} is simply an abstract variable pointing to the proc(5) filesystem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.