AppArmor is a Linux security module that enforces mandatory access control with policy profiles. Instead of trusting every program once it is running, AppArmor can restrict which files it may read or write, which capabilities it may use, and which system resources it may access.
This matters because many attacks succeed only after code is already executing on a host. AppArmor limits the damage that a compromised service, script, or helper can do, and it is widely used in hardened distributions and container-like systems such as Snap. In practice, defenders write or ship profiles in enforce mode, then monitor denials to catch unexpected behavior. Attackers may try to abuse a misconfigured profile, exploit a flaw before confinement is applied, or chain a sandbox escape with another bug to reach higher privileges.