CME-304
AppArmor (Enforcing Profile)
Description
Path-based mandatory access control that restricts per-application file, network, and capability access. Each application runs under a profile defining allowed operations.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Scope (S) | C → U | Process confined to profile-defined resources |
| Confidentiality (C) | H → L | Cannot read files outside profile allowlist |
CWE Relationships
Verification
Check AppArmor status and profile enforcement
$ aa-status --enforced 2>/dev/null | head -5
# Expected: profiles are in enforce mode
# Expected: profiles are in enforce mode
Platform: debian