AA-STATUS(8)

📦
version 6.0.0~alpha1 · 20 versions
, in ubuntu stonking

💅 aa-status(8) — the AppArmor vibe check 💅

okay bestie, so this is the aa-status page from the AppArmor manual, section 8 (that's the sysadmin-y section, iykyk). It's a little tool that tells you what's going on with your AppArmor policy right now. Let's get into it. ✨

🌸 NAME 🌸

aa-status — display various information about the current AppArmor policy.

Like. It just yaps about your confinement state. That's the whole job. 💖

✨ SYNOPSIS ✨

aa-status [option]

One option. That's it. She's low maintenance. 🎀

🦋 DESCRIPTION 🦋

aa-status will report various aspects of the current state of AppArmor confinement. And by "various aspects" I mean she's gonna spill literally everything she knows.

By default — like, if you just run her with no arguments — she displays the same information as if you'd handed her the --verbose argument. Which is a lot. She's not shy.

A sample of what this looks like is:

apparmor module is loaded.
110 profiles are loaded.
102 profiles are in enforce mode.
8 profiles are in complain mode.
Out of 129 processes running:
13 processes have profiles defined.
8 processes have profiles in enforce mode.
5 processes have profiles in complain mode.

Obsessed with her actually. 💅

Other argument options are provided so you can report individual aspects instead of everything, which is the move when you want to use her in scripts and not have a whole wall of text crash the party.

💅 OPTIONS 💅

aa-status accepts only one argument at a time out of these. Pick one, bestie. She's monogamous.

  • --enabled — returns an error code if AppArmor is not enabled. That's it, that's the whole thing. A yes/no vibe check.
  • --profiled — displays the number of loaded AppArmor policies.
  • --enforced — displays the number of loaded enforcing AppArmor policies. These are the ones actually doing the most. 👑
  • --complaining — displays the number of loaded non-enforcing AppArmor policies. They're not enforcing, they're just talking. Valid honestly.
  • --kill — displays the number of loaded enforcing AppArmor policies that will kill tasks on policy violations. 💀 Literally. That's what it does.
  • --prompt — displays the number of loaded enforcing AppArmor policies, with fallback to userspace mediation.
  • --special-unconfined — displays the number of loaded non-enforcing AppArmor policies that are in the special unconfined mode. Special. Unconfined. Main character energy fr fr.
  • --process-mixed — displays the number of processes confined by profile stacks with profiles in different modes.
  • --verbose — displays multiple data points about loaded AppArmor policy set (this is the default action if no arguments are given).
  • --json — displays multiple data points about loaded AppArmor policy set in a JSON format, fit for machine consumption. Robots eat good tonight. 🤖
  • --pretty-json — same as --json, but formatted to be readable by humans as well as by machines. So you can also read it. Iconic of her honestly.
  • --show — what data sets to show information about. Currently processes, profiles, all for both processes and profiles. The default is all.
  • --count — display only counts for selected information. Short and sweet, no yapping.
  • *--filter.mode=filter* — Allows specifying a posix regular expression filter that will be applied against the displayed processes and profiles apparmor profile mode, reducing the output.
  • *--filter.profiles=filter* — Allows specifying a posix regular expression filter that will be applied against the displayed processes and profiles confining profile, reducing the output.
  • *--filter.pid=filter* — Allows specifying a posix regular expression filter that will be applied against the displayed processes, so that only processes pids matching the expression will be displayed.
  • *--filter.exe=filter* — Allows specifying a posix regular expression filter that will be applied against the displayed processes, so that only processes executable name matching the expression will be displayed.
  • --help — displays a short usage statement. The ✨little summary✨ when you can't be bothered to read all of this.

🔥 EXIT STATUS 🔥

Upon exiting, aa-status will set its exit status to the following values. Pay attention bestie, because scripts literally live and die by these numbers:

  1. 0 — if apparmor is enabled and policy is loaded. 🎉 the good timeline
  2. 1 — if apparmor is not enabled/loaded.
  3. 2 — if apparmor is enabled but no policy is loaded.
  4. 3 — if the apparmor control files aren't available under /sys/kernel/security/.
  5. 4 — if the user running the script doesn't have enough privileges to read the apparmor control files. (that's a permissions moment 😭)
  6. 42 — if an internal error occurred. yes, forty-two. the answer. iconic behavior, no notes. 🌈

💀 BUGS 💀

aa-status must be run as root to read the state of the loaded policy from the apparmor module. So like. put on your sudo shoes. 👑

It uses the /proc filesystem to determine which processes are confined and so is susceptible to race conditions. Yes, fr fr, things can change under her feet while she's reading. She's doing her best. 🙈

If you find any additional bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>. Snitch respectfully. 💖

🫶 SEE ALSO 🫶

that's the whole page bestie, you ate. go forth and check your confinement state responsibly. 🌸🦋✨

— AppArmor 6.0.0~alpha1, dated 2026-10-05, section 8, signing off 💜

📦 where this page comes from