How to Configure AppArmor on Ubuntu for Application Security

AppArmor confines applications to a defined set of resources — if a web application is compromised, AppArmor prevents the attacker from accessing files outside the defined profile.

Check Status

sudo apparmor_status
sudo apt install apparmor-utils apparmor-profiles -y

Enable Profile for Nginx

sudo aa-enforce /etc/apparmor.d/usr.sbin.nginx

Create Custom Profile

sudo aa-genprof /usr/bin/myapp
# Run app, then let aa-genprof build profile

Test in Complain Mode

sudo aa-complain /usr/bin/myapp  # log only
sudo aa-logprof                  # review logs
sudo aa-enforce /usr/bin/myapp   # enforce

Conclusion

AppArmor provides defence-in-depth for server applications. Our team implements mandatory access control as part of comprehensive hardening.