AppArmor
Linux security module in Privacy & security
Linux mandatory access control that confines programs and sandboxes untrusted input, with proactive defense praised. Critics say it is hard to configure and exempts some programs.
Linux mandatory access control that confines programs and sandboxes untrusted input, with proactive defense praised. Critics say it is hard to configure and exempts some programs.
26 people gave an opinion
- recommend it
- 15
- criticize it
- 11
- approval share
- 58%
Recommended in 9 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 15 people recommend itNeeds 10 or more, met.
- 1.3 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 9 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Proactive mandatory access control
“In this day and age infrastructure operators should familiarize themselves with proactive defenses”
Comment from 14 May 2026 in “New Nginx Exploit” “It's evident that Mandatory Access Control has become, ahem, mandatory.”
Comment from 27 Aug 2026 in “VMs won't contain cyber-capable agents” Sandboxes untrusted programs and input
“use an LSM like Tomoyo, App Armor or SELinux to not allow the AI to read the secrets file”
Comment from 26 Jun 2026 in “What happened after 2k people tried to hack my AI assistant” “AppArmor profile is probably what you are looking for to run ffmpeg on untrusted input”
Comment from 4 Aug 2026 in “FFmpeg 9.0” “App armor in linux is also nice gvisor like tool”
Comment from 6 Oct 2026 in “Linux containers in 500 lines of code (2016)” Pairs well with SELinux
“Seems the best stopgap is SELinux or AppArmor”
Comment from 21 Oct 2026 in “PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)” “apparmor/selinux pair incredibly well”
Comment from 20 Aug 2026 in “Pacing model development in an era of cyber-critical capabilities”
What people warn about
Each mark is one comment
Progress is slow and incomplete
“AppArmor was a decent step forward, but clearly not enough.”
Comment from 9 May 2026 in “You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)” “I feel like apparmor is getting there, very, very slowly”
Comment from 26 Jan 2026 in “The Browser Is the Sandbox” Browsers and busybox exempted
“With apparmor every single browser (firefox,chrome,msedge,etc...) as well as busybox”
Comment from 9 May 2026 in “You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)” “busybox as an example, which is a required package yet privileged in apparmor”
Comment from 13 Apr 2026 in “Stealthy RCE on Hardened Linux: Noexec and Userland Execution PoC” “Looking at how every browser and busybox is exempted from apparmor”
Comment from 6 Jan 2026 in “Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%” Hard to configure, often disabled
“when people have issues getting software to work, the first thing they are told to try is to turn all that stuff off”
Comment from 30 Nov 2025 in “Landlock-Ing Linux” “so hard to get correctly that everyone on the desktop disables them”
Comment from 30 Nov 2025 in “Landlock-Ing Linux” “causing a few headaches along the way”
Comment from 28 Apr 2026 in “GTFOBins” Outdated design for modern systems
“They look like they are made to comply with some outdated standards from 80s.”
Comment from 19 Jun 2026 in “I found 10k GitHub repositories distributing Trojan malware” “So it is some outdated technology unfit for modern day.”
Comment from 25 Sep 2026 in “Entering and Breaking the Avast Antivirus Sandbox Part 2”
What people recommend instead
The same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| SELinux | 37 | 27 | 58% | 12 | — | — |
| AppArmorThis page | 15 | 11 | 58% | 9 | — | — |
What people said
28 of the 32 comments that mention it, newest first. Each links to the original comment.
“Seems the best stopgap is SELinux or AppArmor”
“apparmor in enforce mode with very strict config”
“App armor in linux is also nice gvisor like tool”
“So it is some outdated technology unfit for modern day.”
“Whitelist, proactive approach. Contrary to SElinux, it's not a programming language, and could be grasped pretty quickly.”
“It's evident that Mandatory Access Control has become, ahem, mandatory.”
“apparmor/selinux pair incredibly well”
“AppArmor profile is probably what you are looking for to run ffmpeg on untrusted input”
“what you want is right here in front of you, is a capability of this very flexible powerful networked system”
“use an LSM like Tomoyo, App Armor or SELinux to not allow the AI to read the secrets file”
“No UAC crap, or horrible systems like AppArmor, no virus scanners, etc...”
“They look like they are made to comply with some outdated standards from 80s.”
“I don't think firejail or apparmour even supports that”
“In this day and age infrastructure operators should familiarize themselves with proactive defenses”
“With apparmor every single browser (firefox,chrome,msedge,etc...) as well as busybox”
“AppArmor was a decent step forward, but clearly not enough.”
“causing a few headaches along the way”
“busybox as an example, which is a required package yet privileged in apparmor”
“which are mostly missing from the tools we have (apparmor, seccomp, oss VMs, seatbelt, docker, bubblewrap etc.)”
“especially in cases where they actively get in the way of security like this”
“I feel like apparmor is getting there, very, very slowly”
“apparmor is trivial to bypass with ld_preload etc”
“Looking at how every browser and busybox is exempted from apparmor”
“layer on security modules like apparmor and seccomp very easily”
“they're not designed for incrementally dropping rights either.”
“when people have issues getting software to work, the first thing they are told to try is to turn all that stuff off”
“so hard to get correctly that everyone on the desktop disables them”
“I ended up having endless warnings and weird bugs”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.