AppArmor Update
summary
Activity shows 2,000+ commits and 141 contributors in six months; CI now boots VMs (Spread and imagegarden) to test multiple distros and kernels instead of container-only runs. AF_UNIX mediation lands in Linux 6.17, AppArmorFS is being rewritten, and apparmor.d policy merges into the main project with policy split into its own repo for distro-specific packaging. Work continues on unprivileged user namespace tightening, FD/object delegation, rule composition, and many performance optimizations.
AI-written summary · about
chapters (17)
- 0:00AppArmor 2025 update intro
- 1:04CI/CD with spread and Image Garden
- 2:32AF_UNIX mediation in Linux 6.17
- 4:38Merging apparmor.d
- 8:11Unprivileged namespace restrictions
- 12:53Capabilities state machine updates
- 15:27AA-Notify bypass alerts
- 16:32Ubuntu permission prompts
- 18:43AppArmor caching improvements
- 20:27Delegation types for policy
- 24:25AppArmor kernel performance
- 27:19State machine memory layout
- 31:55Compile-time optimizations
- 33:01User space CRU compression
- 34:54Expert tree refactoring
- 36:19JIT and state machine stacking
- 38:52AppArmor 5 plans and Q&A
related talks
29mOverview and Recent Developments: AppArmor
07mSubsystem Update: AppArmor Update 2019
09mSub-system Update: AppArmor Update 2018
17mAppArmor
33mBuilding the Largest Working Set of Apparmor Profiles
35mCrackAppArmor Retrospective
50mImproving Unmodified Classic Application Confinement
38mLessons Learned While Making an AppArmor Play Machine