AA-UNCONFINED(8)

💅 AA-UNCONFINED (section 8, bestie) 💅

okay so real talk, this is aa-unconfined from the AppArmor manual, section 8. it's a little tool that snitches on processes. let's get into it 🫶

---

✨ NAME ✨

aa-unconfined — spits out a list of processes with tcp or udp ports that don't have AppArmor profiles loaded. that's literally the whole job. no cap 💁‍♀️

---

🌸 SYNOPSIS 🌸

aa-unconfined [options] [--with-ss | --with-netstat]

---

🎀 OPTIONS 🎀

• --paranoid — shows you every process visible from the /proc filesystem, plus whether each one is confined by a profile or "not confined". this is the exact same thing as --show=all, just with a more dramatic name 💀
• --show=(all|network|server|client) — picks which set of processes gets displayed. the deets:
  • --show=all — show all processes. yep, this is equivalent to --paranoid. same energy.
  • --show=network — only processes with any sockets open.
  • --show=server — only processes with listening sockets open. ⭐ this is the default if you don't pass --show= or --paranoid.
  • --show=client — only processes with non-listening sockets open.
• --with-ss — use the ss(8) command to find processes listening on network sockets. this is the default, so like, you're already doing this ✨
• --with-netstat — use the netstat(8) command to find processes listening on network sockets instead. this is also what aa-unconfined falls back to when ss(8) isn't available. she's got a backup plan 💅

---

🦋 DESCRIPTION 🦋

so aa-unconfined uses netstat(8) to figure out which processes have open network sockets and do not have AppArmor profiles loaded into the kernel. that's it, that's the vibe check. it looks at sockets, it looks at profiles, it tells you who's out here raw and unconfined 😭

---

💀 BUGS 💀

okay bestie, listen up, this part matters:

aa-unconfined must be run as root to retrieve the process executable link from the /proc filesystem. no root, no link, no tea ☕

also this program is susceptible to race conditions of several flavours, and ngl it's kind of a lot:

• an unlinked executable will be mishandled.
• an executable started before an AppArmor profile is loaded will not appear in the output, despite running without confinement. (yes, that's as annoying as it sounds 🙈)
• a process that dies between the netstat(8) call and further checks will be mishandled.

this program only lists processes using TCP and UDP. and in short: this program is unsuitable for forensics use and is provided only as an aid to profiling all network-accessible processes in the lab. like, it's a lab buddy, not a detective 🕵️‍♀️

if you find any bugs, please report them at <https://gitlab.com/apparmor/apparmor/-/issues>. do it for the culture 🫶

---

🌈 SEE ALSO 🌈

ss(8), netstat(8), apparmor(7), apparmor.d(5), aa_change_hat(2), and <https://wiki.apparmor.net>.

---

that's the whole page, bestie, you ate it up 👑

much love from the AppArmor crew — this is version AppArmor 4.1.7, dated 2026-05-19, and it's the AA-UNCONFINED(8) page if you somehow forgot already 💜