AppArmor tips — authorized MAC profile literacy

Last updated: · By the BinBench editorial team · Stars and releases checked via the GitHub API
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.
Quick answer

AppArmor helps authorized labs sample MAC-profile literacy on hosts they own. Pair with selinux-tips, getcap-tips, setcap-tips, capsh-tips, fail2ban-tips. Prefer lab VMs — never disable MAC on foreign hosts without permission.

On this page

Snapshot

FieldValue
SurfaceAppArmor tip checklist
JobAuthorized MAC-profile literacy
SELinux peerselinux-tips
getcap peergetcap-tips
setcap peersetcap-tips
capsh peercapsh-tips

Tip checklist (authorized only)

  1. Confirm you may inspect AppArmor Evidence on the host (lab VM / syllabus box you own or were given access to).
  2. Prefer status/list samples (aa-status) — never unload production profiles without change control.
  3. Record short factual notes; quote short Evidence (profile name, mode enforce/complain — redact paths if sensitive).
  4. Optional: SELinux lane → selinux-tips.
  5. Optional: capability bits → getcap-tips / setcap-tips.
  6. Optional: capability shell → capsh-tips.
  7. Redact hostnames, profile paths, and policy labels if policy requires.
  8. Stop at literacy — no exploit / MAC-bypass cookbooks.

Allowed framing

  • Classroom labs reading AppArmor profiles on authorized disposable hosts.
  • Binding short factual notes as Evidence.
  • Documenting expected vs observed enforce/complain mode for authorized inventory notes.
  • Comparing AppArmor ↔ SELinux / capability peer tip pages under one binder.

Scope we will not cover

  • No crack/pirate/keygen via AppArmor.
  • No intentional MAC-disable / profile-unload PoCs against foreign hosts.
  • No credential-theft via profile paths against hosts you do not own.
  • No bypass cookbooks that weaken confinement without authorization.

Beginner path (authorized only)

  1. Obtain one syllabus-approved lab host you control or may inspect.
  2. Run a short status/list AppArmor sample; quote success.
  3. Bind notes as Evidence; redact hostnames and sensitive paths.
  4. Optional: compare with selinux-tips / getcap-tips.
  5. Stop at literacy — no attack or MAC-bypass cookbooks.
Which to pick
  • Prefer authorized, redacted, status/list Evidence.
  • Use SELinux / capability peer tip pages when the syllabus asks.
  • No exploit, crack, or unauthorized-access framing.

For legal, authorized and educational use only.

FAQ

What is an "AppArmor tip" page in BinBench framing?

A checklist for reading authorized AppArmor profile Evidence on hosts you own or were given syllabus access to — not a cookbook for disabling MAC on foreign hosts.

How does this relate to selinux-tips / getcap-tips / setcap-tips?

Those pages cover SELinux labels and capability bits. This page zooms on a general AppArmor tip checklist — it does not overwrite those pages.

Can I change AppArmor profiles on hosts I do not own?

No. Authorization first. BinBench will not publish unauthorized MAC-disable recipes against foreign hosts.

Does this teach exploit / bypass PoCs via AppArmor?

No. Mentions of exploit/bypass appear only as refusals. Authorized literacy only — prefer lab VMs and complain-mode samples.

Does this teach credential theft via AppArmor?

No. Redact profile paths, hostnames, and policy labels before sharing excerpts.

Sources