AppArmor
AppArmor is the last line of defense: where the WAF stops attacks at the door, AppArmor limits the damage if one gets in. It confines each process (a PHP site, an SSH session) to a profile that says exactly which files and programs it may touch, so a compromised site cannot read /etc/shadow, run a compiler, or reach across into the rest of the system.
Security → AppArmorhttps://YOUR-SERVER-IP:8443/security/apparmor (ROOT only)Three modes, one workflow
Every profile is in one of three modes, and the whole page is built around moving safely between them:
| Mode | What it does |
|---|---|
| Complain | Learning mode: nothing is blocked, but every out-of-policy access is logged. The safe way to start. |
| Enforce | Protection is live: anything outside the profile's rules is blocked. |
| Disabled | The profile is removed from the kernel; no protection. |
The recommended flow is: create a profile in complain mode, let the site run normally while denials accumulate as suggestions, approve the legitimate ones into rules, and once it is quiet (the page suggests after about a week) switch to enforce. That way enforcement never surprises a working site.
Creating a profile
A wizard walks you through it: choose the type (a PHP website, an SSH session, or a system service), pick the domain for a PHP profile, choose a preset template (WordPress, Laravel, standard PHP, or strict security), name it, and pick the starting mode (complain is recommended). The profile is generated from the template, saved, and loaded.
The suggestion engine: denials become rules
This is what makes AppArmor usable rather than a full-time job. When a confined process is denied an action, Panelica reads the kernel's audit log, understands it, and proposes a decision.
/etc/shadow, running gcc, calling sudo, which are flagged high or critical with advice to reject). You approve the legitimate ones, and each approval is written straight into the profile as a rule and reloaded; you reject or ignore the rest./etc/shadow, /etc/sudoers, a compiler (gcc, make), a debugger, or process-control capabilities is the engine telling you something on that site tried to do what a web application never should. Those are the ones to reject, and to investigate: they can be the fingerprint of a break-in that AppArmor just stopped.Events and settings
The Events tab lists the last day's denials in plain language ("this profile tried to do that"), highlighting security-relevant ones (shadow, passwd, compilers, /root). The Settings tab manages the AppArmor service itself (turning it fully on or off, behind a typed confirmation), reloading all profiles, clearing the cache, and setting every managed profile's mode in bulk.
The Profiles tab lists all kernel profiles, not just Panelica's: your PHP-FPM confinements, plus the distribution and Snap and Docker profiles. Panelica's own are marked "Managed" with full controls; the others are read-only reference, though their mode can still be changed with a caution that a package update may revert it.
Access
Strictly ROOT, behind the apparmor license feature (Pro and up). See roles and permissions. AppArmor is availability-guarded: if the underlying AppArmor tools are not installed, the page renders in an unavailable state (rather than crashing), and actions report that AppArmor is not installed.