AA-UNCONFINED(8)

💅 aa-unconfined(8) — the manual page, but make it make sense

okay bestie, welcome to aa-unconfined, section 8 of the AppArmor manual. it's a lil script that spits out a list of processes holding tcp or udp ports that are out here living their lives with no AppArmor profiles loaded. wild, right? let's get into it 🦋

---

✨ NAME ✨

aa-unconfined — outputs a list of processes with tcp or udp ports that do not have AppArmor profiles loaded. that's the whole job. that's the assignment. and she ate. 💖

---

🌸 SYNOPSIS 🌸

aa-unconfined [options] [--with-ss | --with-netstat]

---

🎀 OPTIONS 🎀

• --paranoid — shows literally every process it can see from the /proc filesystem, and tells you whether each one is confined by a profile or "not confined". it's exactly the same as --show=all. maximum nosiness, zero chill. 👑
• --show=(all|network|server|client) — this one decides which set of processes get displayed. pick your fighter:
  • --show=all — shows all processes. this is equivalent to --paranoid (see above, twin behaviour fr).
  • --show=network — shows only processes with any sockets open.
  • --show=server — shows only processes with listening sockets open. this is the default value if --show= or --paranoid aren't specified. so if you just run the thing, this is what you get 💅
  • --show=client — shows only processes with non-listening sockets open.
• --with-ss — uses the ss(8) command to hunt down processes listening on network sockets. this is the default, no cap. ⭐
• --with-netstat — uses the netstat(8) command to hunt down processes listening on network sockets instead. this is also what aa-unconfined will fall back to when ss(8) isn't available. she's got a backup plan, always. 🫶

---

💜 DESCRIPTION 💜

aa-unconfined will use netstat(8) to figure out which processes have open network sockets and do not have AppArmor profiles loaded into the kernel. that's it. that's the vibe check. 🌈

---

💀 BUGS 💀

okay so, important things, listen up:

aa-unconfined must be run as root to retrieve the process executable link from the /proc filesystem. no root, no results, sorry bestie 😭

also this program is susceptible to race conditions of several flavours, and we're gonna list them all because we don't gatekeep:

• an unlinked executable will be mishandled.
• an executable started before an AppArmor profile is loaded will not appear in the output, despite running without confinement. (yeah. that one's sneaky.)
• a process that dies between the netstat(8) call and further checks will be mishandled.

this program only lists processes using TCP and UDP.

in short: this program is unsuitable for forensics use and is provided only as an aid to profiling all network-accessible processes in the lab. do not bring her to court. she is not a witness. 🙈

if you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>.

---

🔥 SEE ALSO 🔥

ss(8), netstat(8), apparmor(7), apparmor.d(5), aa_change_hat(2), and <https://wiki.apparmor.net>. go read them, iykyk 📚

---

okay that's the whole page, you're officially educated ✨ this was AppArmor 6.0.0~alpha1, dated 2026-10-05, and she's still out here doing her little network-accessible-process thing. periodt. 💅🎀🦋