◆Error Codes Wiki

AppArmor Profile Errors — Access Denied and Profile Troubleshooting on Ubuntu

Warningsecurity

Overview

Fix AppArmor profile errors on Ubuntu and Debian preventing applications from accessing files and network resources due to mandatory access control policies.

Key Details

  • AppArmor is the default mandatory access control system on Ubuntu, Debian, and SUSE Linux
  • Profiles define what each application can access: files, network, capabilities
  • Profile modes: enforce (blocks violations), complain (logs only), disabled
  • Profiles stored in /etc/apparmor.d/ as plain text files
  • Denials logged in /var/log/syslog or journalctl with DENIED messages

Common Causes

  • Application profile too restrictive, blocking legitimate file or network access
  • Application binary moved to a non-standard path not covered by the profile
  • New version of application accessing paths not in the existing profile
  • Custom configuration directory not included in the application's AppArmor profile

Steps

  1. 1Check AppArmor status: sudo aa-status to see enforced and complain-mode profiles
  2. 2View denials: journalctl | grep DENIED or grep DENIED /var/log/syslog
  3. 3Set profile to complain mode: sudo aa-complain /path/to/binary to log without blocking
  4. 4After gathering logs in complain mode: sudo aa-logprof to update the profile with new rules
  5. 5Set profile back to enforce: sudo aa-enforce /path/to/binary
  6. 6Disable a specific profile: sudo ln -s /etc/apparmor.d/profile /etc/apparmor.d/disable/ && sudo apparmor_parser -R /etc/apparmor.d/profile

Tags

apparmorubuntuprofilesecuritymandatory-access-control

Related Items

linux-selinux-permission-deniedlinux-permission-denied-chmod-chown

More in Security

windows-defender-errorsWindows Defender Errors — Antivirus Not Working or Updating
Error
windows-error-0x80073b01-defender-serviceWindows Error 0x80073B01 — Windows Defender Service Failed to Start
Error
windows-bitlocker-recovery-key-errorsBitLocker Recovery Key Errors — Drive Locked and Recovery Key Not Found
Critical
mac-gatekeeper-app-blockedMac Gatekeeper — App Cannot Be Opened (Unidentified Developer)
Warning
mac-filevault-recovery-errorsMac FileVault Errors — Encryption, Decryption & Recovery Key Issues
Error
mac-keychain-errors-passwordsMac Keychain Errors — Password Prompts, Locked Keychain, and Repair Guide
Warning

Frequently Asked Questions

Both provide mandatory access control. SELinux uses labels on all objects (more comprehensive, more complex). AppArmor uses file paths (simpler to configure, easier to understand). Ubuntu uses AppArmor, RHEL uses SELinux.