Check AppArmor profiles with `apparmor_status`

The forgotten command that answers 'is AppArmor actually running?' — it separates enforcing profiles, complain-mode profiles and unconfined processes.

LinuxubuntuapparmormacprofilesMedium risk

Run `sudo apparmor_status` to see whether AppArmor is enabled and to list all loaded profiles with their mode (enforce or complain).

01Command

Command

$ sudo apparmor_status

02What it does

Profiles in enforce mode actively block disallowed actions, while complain-mode profiles only log violations — a common surprise is that a profile you expected to protect a service is still in complain mode. To switch one, use the forgotten pair `sudo aa-complain /etc/apparmor.d/NAME` and `sudo aa-enforce /etc/apparmor.d/NAME` (requires the apparmor-utils package). On Fedora or RHEL the equivalent framework is SELinux, so this command simply reports AppArmor not found.

03Risk

RiskMedium risk

RequirementsRequires AppArmor userspace tools (apt install apparmor); default on Ubuntu and openSUSE, not on Fedora/RHEL (SELinux)

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

apparmor_status(8) — display current AppArmor profiles
Ubuntu Manpages · technical · 2026-09-17
Evidence: Documents apparmor_status output: loaded profiles in enforce/complain mode, unconfined processes, and the --profiled/-p flags

Last verified: 2026-09-17 · Category: Security & Privacy