Where Are AppArmor Profiles Stored?
AppArmor profiles live in /etc/apparmor.d with local overrides in /etc/apparmor.d/local. Use parser and status tools to load and check them.
Last updated
Each profile in /etc/apparmor.d controls one executable path. Abstractions and tunables in subfolders provide shared rules.
Local site changes belong in /etc/apparmor.d/local to survive package updates. Disabled profiles are linked under /etc/apparmor.d/disable.
Where AppArmor stores this, by platform
/etc/apparmor.d/
Main profile directory. Needs root to edit. Reload with apparmor_parser or restart the apparmor service after changes. Test in complain mode first to avoid blocks.
/etc/apparmor.d/local/
Site override files included by packaged profiles. Use for added paths and permissions. Keeps custom rules separate from package files during upgrades.
Frequently asked questions
How do I disable a single AppArmor profile?
Link the profile into /etc/apparmor.d/disable and remove it from the kernel with the parser remove option, or use aa-complain to set it to log only. Reload the service and check aa-status.
Why is my edit lost after an update?
Package upgrades can replace files in /etc/apparmor.d. Put lasting changes in the matching file under local so the packaged profile includes them again.
Notice an outdated path? Let us know.