Even with strict file permissions and firewalls in place, your server can still be vulnerable if a core application—such as your web server or database engine—is compromised. If an attacker exploits a zero-day vulnerability in Nginx or PHP, they typically inherit the permissions of the user running that service.

To mitigate this, modern Linux distributions use Mandatory Access Control (MAC) systems. On Ubuntu and Debian-based systems, this is handled by AppArmor. AppArmor confines individual applications to a limited set of resources, ensuring that even if an application is hijacked, the attacker cannot access the rest of your server's file system.

How AppArmor Works

Traditional Linux security uses Discretionary Access Control (DAC), which determines access based on the user executing the program (the owner, group, or others). AppArmor ignores the user entirely and focuses on the program itself.

It uses predefined text files called "profiles." A profile dictates exactly which files, directories, and network ports a specific application is allowed to access. If your web server is compromised and attempts to read a sensitive file like /etc/shadow (which contains your system password hashes), AppArmor will instantly block the read attempt—even if the web server process technically has root privileges.

Checking AppArmor Status

AppArmor is installed and enabled by default on modern Ubuntu releases. You can verify its status and see which applications are currently being confined.

• Connect to your VPS via SSH as a user with sudo privileges.

• Run the command sudo apparmor_status.

• The terminal will output a summary detailing how many profiles are loaded, and how many active processes are currently running under AppArmor confinement.

• You will see lists of processes in "enforce" mode (actively blocked from violating their profiles) and "complain" mode (violations are permitted but logged).

Understanding Enforce vs. Complain Mode

When configuring or troubleshooting AppArmor, you will frequently switch profiles between two operational states.

• Enforce Mode: This is the default security state. If an application attempts to perform an action not explicitly allowed by its profile, AppArmor denies the action instantly.

• Complain Mode: This is the diagnostic state. If an application violates its profile, AppArmor permits the action to succeed but logs the violation heavily in /var/log/syslog or /var/log/audit/audit.log. This mode is crucial for testing new applications to ensure you do not accidentally break functionality by locking them down too tightly.

Managing Application Profiles

To actively switch profiles between modes, you need to install the AppArmor utility package, which provides a set of user-friendly command-line tools.

• Install the utilities by running sudo apt update followed by sudo apt install apparmor-utils.

• To place an application into complain mode for troubleshooting, use the aa-complain command followed by the path to the executable. For example: sudo aa-complain /usr/sbin/nginx.

• To return the application to a strict security state, use the aa-enforce command: sudo aa-enforce /usr/sbin/nginx.

• If you need to completely disable confinement for a specific application because its profile is severely broken, you can create a symlink to the disable directory: sudo ln -s /etc/apparmor.d/usr.sbin.nginx /etc/apparmor.d/disable/ Then parse the profile again: sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.nginx.

Reading the Audit Logs

If an application suddenly stops working after an update, it is highly likely that AppArmor is blocking it in enforce mode because the application is trying to access a new directory.

• Check the kernel logs for AppArmor block messages by running sudo dmesg | grep apparmor.

• Alternatively, look for "DENIED" messages in your system logs: sudo grep "DENIED" /var/log/syslog.

• These log entries will show exactly which profile blocked the action, the target file, and the requested permission (like r for read or w for write), allowing you to manually adjust the profile text file if the access is legitimate.