AppArmor Profile Calculator
Estimate AppArmor mandatory access control coverage from profile mode and rule counts.
Inputs
Total Profile Coverage
55.0%
Enforced (Actively Blocking) Coverage
37.5%
Complain-Mode (Log Only) Coverage
17.5%
Unconfined Processes
18
Effective Protection Summary
Enforce mode is actively blocking violations for 37.5% of processes; complain-mode and unconfined processes remain unprotected.
Step by step
Values used
Profile Mode = Enforce (blocks violations); Total Running Processes/Daemons = 40; Processes With a Loaded Profile = 22; Profiles in Enforce Mode = 15; Profiles in Complain Mode = 7
Coverage
coverage% = profiled_processes / total_processes × 100; enforce_coverage% = enforce_profiles / total_processes × 100
Total Profile Coverage
= 55.0
Enforced (Actively Blocking) Coverage
= 37.5
Complain-Mode (Log Only) Coverage
= 17.5
Unconfined Processes
= 18
Effective Protection Summary
= Enforce mode is actively blocking violations for 37.5% of processes; complain-mode and unconfined processes remain unprotected.
How it works
AppArmor confines individual programs to a limited set of resources via per-executable profiles rather than a single system-wide policy. A profile only provides real protection when loaded in enforce mode — complain mode is a staging step that records what a confined program would have violated (useful for building a profile) without blocking anything. Coverage in this calculator distinguishes the fraction of processes with any profile loaded from the fraction actively enforced, since a high 'profiled' percentage can be misleading if most of those profiles are still in complain mode.
Formula
Coverage
coverage% = profiled_processes / total_processes × 100; enforce_coverage% = enforce_profiles / total_processes × 100
- P_profiled
- processes with a loaded profile
- P_total
- total processes
Frequently Asked Questions
What's the difference between AppArmor enforce and complain mode?
Enforce mode actively blocks and logs any action a profile doesn't explicitly allow. Complain mode only logs what would have been blocked, letting the action proceed — it's meant for building/tuning a profile with `aa-logprof` before switching it to enforce with `aa-enforce`.
How do I check which AppArmor profiles are currently loaded and their mode?
`sudo aa-status` (or `apparmor_status`) lists all loaded profiles grouped by enforce/complain mode along with any unconfined processes that have a profile available but aren't using it.
Does AppArmor replace the need for standard Unix permissions?
No — AppArmor is a mandatory access control (MAC) layer that supplements discretionary Unix permissions (owner/group/other). Even a fully enforced profile only restricts what an already-permitted process can do; it doesn't replace file ownership, mode bits, or SELinux-style labeling on distros that use both.