AppArmor Profile Calculator
Estimate AppArmor profile rule coverage and enforcement mode impact on an application.
About AppArmor Profile Calculator
AppArmor confines individual programs to a limited set of resources via per-executable profiles rather than a single system-wide policy. A profile only provides real protection when loaded in enforce mode — complain mode is a staging step that records what a confined program would have violated (useful for building a profile) without blocking anything. Coverage in this calculator distinguishes the fraction of processes with any profile loaded from the fraction actively enforced, since a high 'profiled' percentage can be misleading if most of those profiles are still in complain mode.
Formula
Coverage
coverage% = profiled_processes / total_processes × 100; enforce_coverage% = enforce_profiles / total_processes × 100
- P_profiled
- processes with a loaded profile
- P_total
- total processes
Worked example
With the default values below, AppArmor Profile Calculator returns Total Profile Coverage of 55.0%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Profile Modeone of Enforce (blocks violations), Complain (logs only), Disabled (no confinement)
- Enforce (blocks violations)
- Total Running Processes/Daemonsminimum 1
- 40
- Processes With a Loaded Profileminimum 0
- 22
- Profiles in Enforce Modeminimum 0
- 15
- Profiles in Complain Modeminimum 0
- 7
Results
- Total Profile Coverage
- 55.0%
- Enforced (Actively Blocking) Coverage
- 37.5%
- Complain-Mode (Log Only) Coverage
- 17.5%
- Unconfined Processes
- 18
- Effective Protection Summary
- Enforce mode is actively blocking violations for 37.5% of processes; complain-mode and unconfined processes remain unprotected.
Step by step
- 1Values used
- 2Coverage
- 3Total Profile Coverage= 55.0
- 4Enforced (Actively Blocking) Coverage= 37.5
- 5Complain-Mode (Log Only) Coverage= 17.5
- 6Unconfined Processes= 18
- 7Effective Protection Summary= Enforce mode is actively blocking violations for 37.5% of processes; complain-mode and unconfined processes remain unprotected.
Assumptions and limits
- The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or compounding frequency into account.
- Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
What's the difference between AppArmor enforce and complain mode?
Enforce mode actively blocks and logs any action a profile doesn't explicitly allow. Complain mode only logs what would have been blocked, letting the action proceed — it's meant for building/tuning a profile with `aa-logprof` before switching it to enforce with `aa-enforce`.
How do I check which AppArmor profiles are currently loaded and their mode?
`sudo aa-status` (or `apparmor_status`) lists all loaded profiles grouped by enforce/complain mode along with any unconfined processes that have a profile available but aren't using it.
Does AppArmor replace the need for standard Unix permissions?
No — AppArmor is a mandatory access control (MAC) layer that supplements discretionary Unix permissions (owner/group/other). Even a fully enforced profile only restricts what an already-permitted process can do; it doesn't replace file ownership, mode bits, or SELinux-style labeling on distros that use both.