A few days ago, March 10th 2026 to be precise, Qualys issued a Security Advisory CrackArmor: Multiple vulnerabilities in AppArmor.
It highlights about
9 (nine) vulnerabilities in AppArmor
Not all the details are given.
Having read this I still have doubts. Are these serious? What are the mitigation steps that can be taken till the Linux Kernel team fixes these? And finally how to know if the vulnerability has been used or not?
Well…first are you using apparmor? We aren’t using it by default here. It is mostly used on Ubuntu and it’s derivatives. As far as I know, it isn’t even enabled by default on Arch kernels. You need to enable it via a kernel parameter.
Is it running? :
aa-enabled
What’s it’s status? (just for your reference, no need to share) :
sudo aa-status
In light of the vulnerabilities you’ve noted, for layered security you might consider running select applications with firejail also. Universally enabling firejail can be a bit of a chore, so I’d recommend handling it per-application, or even just ones you’re particularly concerned about.
Yes I have enabled it via a kernel parameter which is passed from GRUB to the Linux Kernel. The parameter is apparmor=1. I am trying to setup up a few internet connecting applications using apparmor.
Since firejail is not part of Linux Kernel like AppArmor and SELinux, should it be looked at? I had not looked at it. Had found a lot of articles on the net which have firejail working in conjunction with AppArmor. Also AppArmor allows fine grain control based on Linux Capabilities. Does firejail also has the same? Or is it like sudo?
In a nutshell, firejail provides configurable sandboxing.
The benefit of that being, if the application you’re running via firejail is malicious, or has an exploitable vulnerability (eg: web browser, from which firejail originally derived it’s name), the damage that can be inflicted is greatly limited.
The extent to which it is sand-boxed is configurable using profiles. Many are provided already, but you can also create your own, or rely on command line arguments to configure options.
As mentioned, I would suggest against universally enabling it for all supported profiles, as it can start to hinder your usage too much. But it’s worth toiling with for your major apps.
Edit: It’s also worth noting that firejail works with AppArmor. It’s not either/or, which is why I suggested it as an approach to layered security. Where one may fall short, the other provides a safety net.