Keep no AppArmor profile in complain mode

Description

Each loaded AppArmor profile runs in a mode. In enforce mode, accesses outside the profile are blocked and logged. In complain mode, they are only logged. Profiles flagged unconfined are a third case: they do not restrict the program but attach specific rights to it (Debian 13 ships many of them for user namespace mediation), and are out of scope here.

Rationale

Complain mode is meant for writing and testing profiles. A profile left in complain mode in production gives a false sense of confinement: the program is not restricted at all.

Impact

Switching a profile to enforce mode can break the program it covers if the profile is incomplete. Debian 13 ships several profiles in complain mode on purpose; enforce them one by one, checking the logs (journalctl -k | grep apparmor) for denials.

Audit

Run aa-status --complaining. It must print 0. aa-status lists the profiles in complain mode by name.

Automated: every check must pass. Scanners report each check by its id.

complain-count

Number of loaded profiles in complain mode.

script: |
  n=$(aa-status --complaining 2>/dev/null) || exit 3
  echo "$n"
  [ "$n" -eq 0 ]

Remediation

1. List the profiles in complain mode: aa-status.
2. For each one, install apparmor-utils and run aa-enforce /etc/apparmor.d/<profile>.
3. Watch for denials with journalctl -k | grep apparmor and fix or revert the profile.

Rollback

Put a profile back in complain mode with aa-complain /etc/apparmor.d/<profile>.

References

• aa-status(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• Debian Wiki - AppArmor/HowToUse Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R45) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-DEB-BOOT-008 Install and enable AppArmor

People and lifecycle