October 8, 2026 | Prague, Czechia View More Details & Registration | Note: The schedule is subject to change. You must be registered for Linux Security Summit Europe 2026 to participate in the sessions. Please visit the event registration page to purchase a ticket.
Sign up or log in to add sessions to your schedule and sync them to your phone or calendar.
Upstream AppArmor ships around 120 confining profiles, mostly for system and network services, so most applications run unconfined. apparmor.d, the main effort at comprehensive confinement, ships around 1,700 profiles but barely reaches production. No distribution enables it, for good reasons: enforcing them all is heavy on CPU and memory; many profiles are unused or too strict for interactive use, breaking applications; complain mode gives no real protection but floods the logs. Finally, when a software update breaks a profile, nothing notices.
We present an end-to-end pipeline that turns a profile set like apparmor.d into shipped, maintained policy with working, open-source tooling at each stage. Distro-agnostic automated testing (autopkgtest, upstream, spread, custom) and refinement cut authoring and upkeep to a small, evidence-backed review. aa-sync, an upstream RFC, ships every profile read-only and enforces only the vetted subset matched to the user's needs and installed applications. It grows coverage as profiles mature, and re-syncs after each package transaction so confinement survives updates, a step towards to fully confined systems.
