Linux Security Summit North America 2026

AppArmor has traditionally used a more static type enforcement style policy, where all object accesses must be explicitly allowed within the a subjects profile. However this can result in policy that has overly broad access rights to cover all the potential accesses the application may do.

Object capabilities allow passing objects to a subject such that the object carries the opening tasks access rights. This allows extending a subject access permissions dynamically. Allowing for smaller more dynamic policy, but while loosing some of the advantages of the more static type enforcement policy.

This presentation will discuss how AppArmor is bringing bounded object delegation to its policy, and the the affects it has on how this can change how policy is authored.