AA-NOTIFY(8)

💖 aa-notify — the AppArmor gossip channel (aa-notify(8)) 💖

okay so bestie, real talk: this is the aa-notify page from section 8 of the manual, and it's basically the little birdie that tells you what AppArmor's been denying behind your back. Let's get into it 🦋

---

✨ NAME ✨

aa-notify — display information about logged AppArmor messages. she's a messenger, that's the whole job 💅

🌸 SYNOPSIS 🌸

aa-notify [option]

that's it, that's the vibe. one optional little option, no chaos 🌈

🎀 DESCRIPTION 🎀

aa-notify will display a summary or provide desktop notifications for AppArmor DENIED messages. so when AppArmor goes "nope, blocked" to something, this is how you find out — either as a cute recap or as a popup that shows up on your desktop. iconic behavior honestly 👑

💜 OPTIONS 💜

aa-notify accepts the following arguments:

• -p, --poll — poll AppArmor logs and display desktop notifications. you can pair it with the -s option to display a summary on startup, so you get the recap and the live updates 🫶
• --display $DISPLAY — set the DISPLAY environment variable to $DISPLAY. ngl this one might be needed if sudo resets $DISPLAY on you, which it loves to do 😭
• *-f *FILE, --file=FILE — search FILE for AppArmor messages. point her at a specific file instead of letting her roam 💫
• -l, --since-last — show summary since last login. a little "what did I miss while I was away" moment ✨
• *-s *NUM, --since-days=NUM — show summary for last NUM of days. pick your window, she'll do the math 🍓
• *-u *USER, --user=USER — user to drop privileges to when running privileged. when used with the -p option, this should be set to the user that will receive desktop notifications. careful though: this has no effect when running under sudo 💀 (yes, that's a real caveat, don't come for me)
• *-w *NUM, --wait=NUM — wait NUM seconds before displaying notifications (for use with -p). patience is a virtue, or whatever 🧚
• -v, --verbose — show messages with summaries. she'll give you the full tea, not just the headline 🌸
• -h, --help — displays a short usage statement. the classic "wait what do I do" button 🎀

🌈 CONFIGURATION 🌈

System-wide configuration for aa-notify is done via /etc/apparmor/notify.conf:

# Set to 'no' to disable AppArmor notifications globally
show_notifications="yes"

# Special profiles used to remove privileges for unconfined binaries using user namespaces. If unsure, leave as is.
userns_special_profiles="unconfined,unprivileged_userns"

# Theme for aa-notify GUI. See https://ttkthemes.readthedocs.io/en/latest/themes.html for available themes.
interface_theme="ubuntu"

# Binaries for which we ignore userns-related capability denials
ignore_denied_capability="sudo,su"

# OPTIONAL - kind of operations which display a popup prompt.
prompt_filter="userns"

# OPTIONAL - restrict using aa-notify to users in the given group
# (if not set, everybody who has permissions to read the logfile can use it)
# use_group="admin"

# OPTIONAL - custom notification message body
message_body="This is a custom notification message."

# OPTIONAL - custom notification message footer
message_footer="For more information visit https://foo.com"

# OPTIONAL - custom notification filtering
# Filters are used to reduce the output of information to only those entries that will match the filter. Filters use Python's regular expression syntax.
filter.profile="^(foo|bar)$"  # Match the profile:            Only shows notifications for profiles "foo" or "bar"
filter.operation="^open$"     # Match the operation:          Only shows notifications for "open" operation
filter.name="^(?!/usr/lib/)"  # Match the name:               Excludes notifications for names starting by "/usr/lib/"
filter.denied="^r$"           # Match the denied_mask:        Only shows notifications where "r", and only "r", was denied
filter.family="^inet$"        # Match the network family:     Only shows notifications for "inet" family
filter.socket="stream"        # Match the network socket type: Only shows notifications for "stream" sockets

Per-user configuration is done via $XDG_CONFIG_HOME/apparmor/notify.conf (or the deprecated ~/.apparmor/notify.conf if it exists):

# set to 'yes' to enable AppArmor DENIED notifications
show_notifications="yes"

heads up bestie: that ~/.apparmor/notify.conf path is straight-up deprecated, so treat $XDG_CONFIG_HOME/apparmor/notify.conf as the main character here 👑 and note that if use_group isn't set, everybody who has permissions to read the logfile can use it — keep that in mind 💅

💀 BUGS 💀

aa-notify needs to be able to read the logfiles containing the AppArmor DENIED messages. no logfile access, no tea. periodt 😭

If you find any additional bugs, please report them to Gitlab at <https://gitlab.com/apparmor/apparmor/-/issues>. do it bestie, they want to know 🫶

🔥 SEE ALSO 🔥

apparmor(7) — go read the parent page when you're done here, iykyk ✨

---

and that's the whole page, no cap 💖 this beauty comes to you from AppArmor 4.1.7, dated 2026-05-19 — mwah, go forth and get notified 🌸🎀🦋