AA-ENFORCE(8)

✨ NAME ✨

okay so bestie, let me put you on 💅 — aa-enforce is the AppArmor girlie whose whole job is flipping a security profile into enforce mode, pulling it out of disabled-or-complain limbo. That's it. That's the gig. 👑

---

🌸 SYNOPSIS 🌸

aa-enforce <executable> [<executable> ...] [-d /path/to/profiles]
[--no-reload] [--force]

---

💖 OPTIONS 💖

• -d, --dir path/to/profiles — tells AppArmor where to go looking for the security profile set, aka the lil neighborhood where all your profiles live. It defaults to /etc/apparmor.d if you don't say anything. 🏠
• --no-reload — do not reload the profile after modifying it. it's giving "I changed it but I'm not refreshing the page," iykyk. 🙈
• --force — grabs the profile and slams it into enforce mode even when it's currently sitting in unconfined mode. no cap, it does not ask permission first. 🔥

---

🦋 DESCRIPTION 🦋

So aa-enforce sets one or more profiles to enforce mode — that's the main character moment. ✨

But here's the lore: this command only really means anything when it's hanging out next to its two besties:

• the aa-complain utility, which flips a profile into complain mode, and
• the aa-disable utility, which unloads a profile and disables it entirely.

And listen — the default mode for a security policy is already enforce. So if you want literally anything else, you have to go run the aa-complain utility to switch that behavior up. The system ships enforcing, periodt. 💅

---

💀 BUGS 💀

Found a bug? Not the vibe. 😭 Please report it at <https://gitlab.com/apparmor/apparmor/-/issues> so the maintainers can deal with it.

---

🌈 SEE ALSO 🌈

• apparmor(7)
• apparmor.d(5)
• aa-complain(1)
• aa-disable(1)
• aa_change_hat(2)
• and <https://wiki.apparmor.net>

---

okay that's the whole page bestie, you're soooo welcome 🫶 this was the AppArmor manual, section 8, written by the AppArmor girlies — AppArmor 6.0.0~alpha1, dated 2026-10-05. mwah 💖🎀