I want to only white-list applications that can run on my system using Apparmor, I know it is used to confine applications/programs based on their path names, but what I need is to contain those applications to run in confinement, and everything else is black-listed .. Can I do that in Apparmor, or I'm talking about the wrong tools.
If you look at an AppArmor rule-set or do any research into AppArmor you can see that they are designed to lock down a specific process. AppArmor is in no way shape or form a solution to "white-list" processes, nor will it ever be.
By default AppArmor whitelists all applications/programs. To setup apparmor so all applications/programs by default are blacklisted then you need to setup AppArmor Full System Policy. This is not a simple task but can definitely be done. Refer to the link for the details: https://gitlab.com/apparmor/apparmor/wikis/FullSystemPolicy
A Linux system contains a lot of "applications" -- do a
ls /usr/bin to see it. Many of these must be launched regularly for proper system operation, not only at boot but also afterwards. Also, a lot of applications rely on the ability to launch these other applications, without necessarily making it apparent to the human user. Anything which looks like a shell script, for instance, will use dozens of them.
So if you succeeded at making a restrictive white-list, the predictable effect would be a computer which boots up no more than a brick. Secure indeed.
Analogy: imagine a surgeon, or maybe a student who wants to become a surgeon; he has a patient to take care of. His strategy his simple: he will use his scalpel to open up the patient and remove any organ whose function he does not know, or that does not seem really necessary. Now estimate the life expectancy of the patient.