Estimate AppArmor profile rule coverage and enforcement mode impact on an application.
AppArmor confines individual programs to a limited set of resources via per-executable profiles rather than a single system-wide policy. A profile only provides real protection when loaded in enforce mode — complain mode is a staging step that records what a confined program would have violated (useful for building a profile) without blocking anything. Coverage in this calculator distinguishes the fraction of processes with any profile loaded from the fraction actively enforced, since a high 'profiled' percentage can be misleading if most of those profiles are still in complain mode.
Coverage
coverage% = profiled_processes / total_processes × 100; enforce_coverage% = enforce_profiles / total_processes × 100
Enforce mode actively blocks and logs any action a profile doesn't explicitly allow. Complain mode only logs what would have been blocked, letting the action proceed — it's meant for building/tuning a profile with `aa-logprof` before switching it to enforce with `aa-enforce`.
`sudo aa-status` (or `apparmor_status`) lists all loaded profiles grouped by enforce/complain mode along with any unconfined processes that have a profile available but aren't using it.
No — AppArmor is a mandatory access control (MAC) layer that supplements discretionary Unix permissions (owner/group/other). Even a fully enforced profile only restricts what an already-permitted process can do; it doesn't replace file ownership, mode bits, or SELinux-style labeling on distros that use both.