I want to only white-list applications that can run on my system using Apparmor, I know it is used to confine applications/programs based on their path names, but what I need is to contain those applications to run in confinement, and everything else is black-listed .. Can I do that in Apparmor, or I'm talking about the wrong tools.
By default AppArmor whitelists all applications/programs. To setup apparmor so all applications/programs by default are blacklisted then you need to setup AppArmor Full System Policy. This is not a simple task but can definitely be done. Refer to the link for the details: https://gitlab.com/apparmor/apparmor/wikis/FullSystemPolicy
A Linux system contains a lot of "applications" -- do a
ls /usr/bin to see it. Many of these must be launched regularly for proper system operation, not only at boot but also afterwards. Also, a lot of applications rely on the ability to launch these other applications, without necessarily making it apparent to the human user. Anything which looks like a shell script, for instance, will use dozens of them.
So if you succeeded at making a restrictive white-list, the predictable effect would be a computer which boots up no more than a brick. Secure indeed.
Analogy: imagine a surgeon, or maybe a student who wants to become a surgeon; he has a patient to take care of. His strategy his simple: he will use his scalpel to open up the patient and remove any organ whose function he does not know, or that does not seem really necessary. Now estimate the life expectancy of the patient.