APPARMOR_XATTRS(7)

✨ APPARMOR_XATTRS ✨

okay bestie, this is the apparmor_xattrs page from the AppArmor manual (section 7, we love a deep-cut) 💅

---

💖 NAME 💖

apparmor_xattrs — AppArmor profile xattr(7) matching. yes we're matching on extended attributes now, it's giving very specific girl energy and we're obsessed 🎀

---

🌸 DESCRIPTION 🌸

so here's the tea, bestie: AppArmor profiles can conditionally match files based on the presence and value of extended attributes, on top of the file path. like, you don't just have to say "this is the file" — you can say "this is the file AND it's got this vibe in its xattrs" ✨

The following profile applies to any file under "/usr/bin" where the "security.apparmor" extended attribute has the value "trusted":

profile trusted /usr/bin/* xattrs=(security.apparmor="trusted") {
    # ...
}

Note that "security.apparmor" and "trusted" are arbitrary — like, those are just the names in this example, and profiles can match based on the value of any attribute. you're not locked into those, iykyk 💜

The xattrs value may also contain a path regex:

profile trusted /usr/bin/* xattrs=(user.trust="tier/*") {

    # ...
}

The getfattr(1) and setfattr(1) tools can be used to view and manage xattr values:

$ setfattr -n 'security.apparmor' -v 'trusted' /usr/bin/example-tool
$ getfattr --absolute-names -d -m - /usr/bin/example-tool
# file: usr/bin/example-tool
security.apparmor="trusted"

look at her go 🫶

---

🏆 priority, aka main character ranking 🏆

The priority of each profile is determined by the length of the path, then the number of xattrs specified. A more specific path is preferred over xattr matches:

# Highest priority, longest path.
profile example1 /usr/bin/example-tool {
    # ...
}

# Lower priority than the longer path, but higher priority than a rule
# with fewer xattr matches.
profile example2 /usr/** xattrs=(
    security.apparmor="trusted"
    user.domain="**"
) {
    # ...
}

# Lowest priority. Same path length as the second profile, but has
# fewer xattr matches.
profile example2 /usr/** {
    # ...
}

so basically: longest path wins first, and then if it's a tie, the one with more xattr matches takes it. slay. 👑

---

🧚 the kernel feature check 🧚

xattr matching requires the following kernel feature:

/sys/kernel/security/apparmor/features/domain/attach_conditions/xattr

like, no feature file, no xattr matching. that's the whole vibe check bestie 😭

---

💀 KNOWN ISSUES 💀

AppArmor profiles currently can't reliably match extended attributes with binary values such as security.evm and security.ima. 💀

not us being unable to read those. it's giving "we tried." In the future AppArmor may gain the ability to match based on the presence of certain attributes while ignoring their values — so like, "is it there?" without the "what does it say?" 🌈

---

👀 SEE ALSO 👀

apparmor(8), apparmor_parser(8), apparmor.d(5), xattr(7), aa-autodep(1), clean(1), auditd(8), getfattr(1), setfattr(1), and <https://wiki.apparmor.net>.

---

mwah 💋 this was AppArmor 6.0.0~alpha1, dated 2026-10-05, and yeah it's an alpha so be nice to her. periodt. 🎀✨