I want to only white-list applications that can run on my system using Apparmor, I know it is used to confine applications/programs based on their path names, but what I need is to contain those applications to run in confinement, and everything else is black-listed .. Can I do that in Apparmor, or I'm talking about the wrong tools.


If you look at an AppArmor rule-set or do any research into AppArmor you can see that they are designed to lock down a specific process. AppArmor is in no way shape or form a solution to "white-list" processes, nor will it ever be.

  • 1
    "nor will it ever be" isn't very clear. Why will it never be? security.stackexchange.com/a/122458/78115 makes it sound like it is actually possible (though perhaps difficult or uncommon). – David Baird May 18 '19 at 17:27
  • This is wrong. There is active work on allowing a global AppArmor policy. At the very minimum, you can set a whitelist on your init program to do this. – forest May 19 '19 at 1:29

By default AppArmor whitelists all applications/programs. To setup apparmor so all applications/programs by default are blacklisted then you need to setup AppArmor Full System Policy. This is not a simple task but can definitely be done. Refer to the link for the details: https://gitlab.com/apparmor/apparmor/wikis/FullSystemPolicy


A Linux system contains a lot of "applications" -- do a ls /usr/bin to see it. Many of these must be launched regularly for proper system operation, not only at boot but also afterwards. Also, a lot of applications rely on the ability to launch these other applications, without necessarily making it apparent to the human user. Anything which looks like a shell script, for instance, will use dozens of them.

So if you succeeded at making a restrictive white-list, the predictable effect would be a computer which boots up no more than a brick. Secure indeed.

Analogy: imagine a surgeon, or maybe a student who wants to become a surgeon; he has a patient to take care of. His strategy his simple: he will use his scalpel to open up the patient and remove any organ whose function he does not know, or that does not seem really necessary. Now estimate the life expectancy of the patient.

  • 1
    I don't really agree with you regarding that making a restrictive white-list is impractical .. because SElinux does this by tagging each process in the system, and those tagged processes follow a determined policy .. otherwise the process is not allowed to run. Actually, it is a tradeoff between security and usability, and to what extent you want to secure your system based on how sensitive data it holds! – securecurve Sep 18 '13 at 6:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.