AppArmor
also: MAC, Mandatory Access Control
AppArmor is a Linux security module that restricts programs' capabilities by enforcing mandatory access control (MAC) policies on a per-application basis.
AppArmor is a kernel-level security framework that confines individual applications to a limited set of resources and capabilities. Rather than controlling access based on user identity alone, AppArmor uses security profiles to define exactly what system resources—files, network sockets, capabilities—each program is allowed to access.
Each application gets its own profile that whitelist-style specifies what it can do. For example, a web server profile might allow read access to /var/www/ but deny access to /home/ and restrict network binding to specific ports. If the application is compromised or behaves maliciously, the damage is contained to what AppArmor permits.
AppArmor profiles exist in two modes: complain mode (logs violations without blocking) and enforce mode (blocks violations). This makes it easier to develop and test policies before enforcing them in production.
AppArmor is simpler and more readable than SELinux, making it popular on Ubuntu and Debian systems. It complements standard Linux permissions to provide defense-in-depth against privilege escalation and application exploits.