AA-NOTIFY(8)

🌸 AA-NOTIFY(8) — aa-notify: your AppArmor DENIED-message bestie 💅

✨ NAME ✨

aa-notify is your bestie for displaying information about logged AppArmor messages — literally the receipts. 💖

🦋 SYNOPSIS 🦋

aa-notify [option]

💖 DESCRIPTION 💖

Okay so aa-notify will show you a summary or provide desktop notifications for AppArmor DENIED messages. That’s the whole vibe, periodt: AppArmor said no, and aa-notify helps you see the receipts. ✨

🔥 OPTIONS 🔥

aa-notify accepts the following arguments — collect them like Pokémon, but only the ones you need:

• -p, --poll — polls AppArmor logs and shows desktop notifications. You can pair it with the -s option to display a summary on startup. 👀
• --display $DISPLAY — sets the DISPLAY environment variable to $DISPLAY; this might be needed if sudo resets $DISPLAY. (sudo really said “new phone who dis” to your display 😭)
• -f FILE, --file=FILE — searches FILE for AppArmor messages. Give it the file and let it snoop. 🔍
• -l, --since-last — shows a summary since last login. Welcome back, here’s the recap. 🫶
• -s NUM, --since-days=NUM — shows a summary for the last NUM of days. Math but make it AppArmor. ✨
• -u USER, --user=USER — the user to drop privileges to when running privileged. When you use it with the -p option, this should be set to the user who will receive desktop notifications. This has no effect when running under sudo. The sudo plot twist is real. 😭
• -w NUM, --wait=NUM — waits NUM seconds before displaying notifications (for use with -p). Patience, queen. ⏳
• -v, --verbose — shows messages with summaries. More tea, more context. 🍵
• -h, --help — displays a short usage statement. The classic “help me help you” moment. 🎀

🌈 CONFIGURATION 🌈

System-wide config for aa-notify lives at /etc/apparmor/notify.conf — here’s the whole config mood board, comments and all. It’s giving config couture:

  # Set to 'no' to disable AppArmor notifications globally
  show_notifications="yes"

  # Special profiles used to remove privileges for unconfined binaries using user namespaces. If unsure, leave as is.
  userns_special_profiles="unconfined,unprivileged_userns"

  # Theme for aa-notify GUI. See https://ttkthemes.readthedocs.io/en/latest/themes.html for available themes.
  interface_theme="ubuntu"

  # Binaries for which we ignore userns-related capability denials
  ignore_denied_capability="sudo,su"

  # OPTIONAL - kind of operations which display a popup prompt.
  prompt_filter="userns"

  # OPTIONAL - restrict using aa-notify to users in the given group
  # (if not set, everybody who has permissions to read the logfile can use it)
  # use_group="admin"

  # OPTIONAL - custom notification message body
  message_body="This is a custom notification message."

  # OPTIONAL - custom notification message footer
  message_footer="For more information visit https://foo.com"

  # OPTIONAL - custom notification filtering
  # Filters are used to reduce the output of information to only those entries that will match the filter. Filters use Python's regular expression syntax.
  filter.profile="^(foo|bar)$"  # Match the profile:            Only shows notifications for profiles "foo" or "bar"
  filter.operation="^open$"     # Match the operation:          Only shows notifications for "open" operation
  filter.name="^(?!/usr/lib/)"  # Match the name:               Excludes notifications for names starting by "/usr/lib/"
  filter.denied="^r$"           # Match the denied_mask:        Only shows notifications where "r", and only "r", was denied
  filter.family="^inet$"        # Match the network family:     Only shows notifications for "inet" family
  filter.socket="stream"        # Match the network socket type: Only shows notifications for "stream" sockets

Per-user config is done via $XDG_CONFIG_HOME/apparmor/notify.conf (or the deprecated ~/.apparmor/notify.conf if it exists):

Heads up: ~/.apparmor/notify.conf is deprecated — it’s used if it exists. 🫶

  # set to 'yes' to enable AppArmor DENIED notifications
  show_notifications="yes"

🐛 BUGS 🐛

Okay so aa-notify needs to be able to read the logfiles containing the AppArmor DENIED messages. That’s the price of admission. If it can’t read them, it can’t spill the tea. 💀

If you find any additional bugs, please report them to Gitlab at <https://gitlab.com/apparmor/apparmor/-/issues>. The maintainers will appreciate the heads-up, fr fr. 🫶

👀 SEE ALSO 👀

apparmor(7) — go read it if you want the bigger AppArmor picture. 💜

---

xoxo 💋 this page is from AppArmor 4.1.8, dated 2026-10-18. Stay iconic, bestie! ✨