Keep no AppArmor profile in complain mode

Description

Each loaded AppArmor profile runs in a mode. In enforce mode, accesses outside the profile are blocked and logged. In complain mode, they are only logged. Profiles flagged unconfined are a third case: they do not restrict the program but attach specific rights to it (Ubuntu 24.04 and later ship many of them for user namespace mediation), and are out of scope here.

Snap applications get profiles generated by snapd (snap.<name>.<app>). A snap installed with --devmode runs with its profiles in complain mode.

Rationale

Complain mode is meant for writing and testing profiles. A profile left in complain mode in production gives a false sense of confinement: the program is not restricted at all.

Impact

Switching a profile to enforce mode can break the program it covers if the profile is incomplete. Ubuntu ships some profiles in complain mode on purpose (the transmission-* profiles on 24.04, Xorg and Xorg_wrap on 26.04, on a server image); enforce them one by one, checking the logs (journalctl -k | grep apparmor) for denials. On a desktop, enforcing Xorg can break an Xorg session: test it before rolling it out.

Audit

Run aa-status --complaining. It must print 0. aa-status lists the profiles in complain mode by name.

Automated: every check must pass. Scanners report each check by its id.

complain-count

Number of loaded profiles in complain mode.

script: |
  n=$(aa-status --complaining 2>/dev/null) || exit 3
  echo "$n"
  [ "$n" -eq 0 ]

Remediation

1. List the profiles in complain mode: aa-status.
2. For each one, install apparmor-utils and run aa-enforce /etc/apparmor.d/<profile>.
3. Watch for denials with journalctl -k | grep apparmor and fix or revert the profile.
4. Snap profiles cannot be changed with aa-enforce: snapd regenerates them. Reinstall a devmode snap in strict confinement (snap refresh --jailmode <snap> or without --devmode), or remove it.

Rollback

Put a profile back in complain mode with aa-complain /etc/apparmor.d/<profile>.

References

• Snapcraft documentation - Snap confinement Canonical, vendor-doc, accessed 2026-10-19
• aa-status(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• Ubuntu Server documentation - AppArmor Canonical, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R45) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-UBU-BOOT-008 Install and enable AppArmor

People and lifecycle