Working with AppArmor profiles on Debian and Ubuntu: status, complain mode and local overrides

Goal

Diagnose why AppArmor is blocking a legitimate action, loosen only that one profile temporarily, and add a permanent, upgrade-safe exception.

Prerequisites

apparmor-utils installed for aa-status/aa-complain/aa-enforce (Debian 12/13 and Ubuntu 22.04/24.04 all ship it); root access; access to the systemd journal.

Steps

1. See what is loaded: aa-status. The manual page describes it as reporting the current state of AppArmor confinement and, among other counts, "displays the number of loaded AppArmor policies" broken down by enforce and complain mode.
2. Find denials in the journal: journalctl -k | grep -i apparmor (or search for apparmor="DENIED"), which shows the profile name, the operation and the path that was blocked.
3. If a legitimate action is being denied, switch that one profile to complain mode instead of disabling AppArmor entirely: aa-complain /path/to/binary (or a profile name). aa-complain is documented as setting "an AppArmor security profile to complain mode", where violations are logged but not blocked.
4. Reproduce the action, confirm it now works, and read the fresh journalctl denial entries to see exactly which permission (path, capability) was missing.
5. Add the missing permission as a local override rather than editing the shipped profile directly: create or edit the matching file under /etc/apparmor.d/local/ (Ubuntu's server documentation notes this directory holds files "for the packages that are known to sometimes need slight tweaks", and it survives package upgrades that replace the main profile).
6. Reload the profile (apparmor_parser -r /etc/apparmor.d/<profile>) and return it to blocking mode: aa-enforce /path/to/binary, which "set[s] an AppArmor security profile to enforce mode".
7. Re-run aa-status to confirm the profile is listed under enforce mode again, and repeat step 2 to confirm no new denials appear.

Expected result

aa-status shows the profile back in enforce mode, and the journal shows no further DENIED entries for the previously blocked action.

Limits and test basis

Leaving a profile in complain mode is a temporary diagnostic state, not a fix — it logs violations without stopping them. No reboot is required; apparmor_parser -r reloads a single profile immediately. To back out entirely, remove the local override file and reload the profile again.