# info > APPARMOR_PARSER

---
type: CommandReference
command: apparmor_parser
mode: man
section: 8
source: man-pages
---

## Quick Reference
- `apparmor_parser -a <profile>` — add a profile (default)
- `apparmor_parser -r <profile>` — replace an existing profile
- `apparmor_parser -R <profile>` — remove a profile
- `apparmor_parser -C <profile>` — load in complain mode
- `apparmor_parser -S <profile>` — write binary cache to stdout
- `apparmor_parser -K <profile>` — skip all caching
- `apparmor_parser -v <profile>` — verbose output
- `apparmor_parser -h` — help summary

## Name
**apparmor_parser** — loads AppArmor profiles into the Linux kernel

## Synopsis
apparmor_parser [options] <command> [profiles]...
apparmor_parser [options] <command>
apparmor_parser [-hv] [--help] [--version]
## Options
### Commands (privileged)
- `-a, --add` — insert profile(s) into kernel; default action. Error if profile already exists.
- `-r, --replace` — replace an existing profile in the kernel.
- `-R, --remove` — remove a profile from the kernel (requires full profile definition).

### Unprivileged commands
- `-V, --version` — print version number and exit.
- `-h, --help` — give quick reference guide.
- `-N, --names` — list policy names from given profiles (implies `-K`).
- `-p, --preprocess` — flatten includes into output and dump to stdout.
- `-S, --stdout` — write binary (cached) profile to stdout (implies `-K`, `-T`).
- `-o, --ofile <file>` — write binary cache to file (implies `-K`, `-T`).
- `--purge-cache` — unconditionally clear cached profiles.

### Profile loading options
- `-B, --binary` — treat input as binary cache files (implies `-K`, `-T`).
- `-C, --Complain` — force profile into complain mode.
- `-b, --base <n>` — set base directory for relative `#include` directives.
- `-I, --Include <n>` — add directory to search path for absolute `#include`.
- `-f, --apparmorfs <n>` — set location of apparmor security filesystem (default: `/sys/kernel/security/apparmor`).
- `--policy-features <n>` — specify feature set policy was developed under.
- `--override-policy-abi <n>` — specify feature set and override policy ABI rules.
- `--kernel-features <n>` — specify kernel feature set (default: system's kernel).
- `-M, --features-file <n>` — use features file at path (default: `/etc/apparmor.d/cache/.features`). Sets both kernel and policy features.
- `-m, --match-string <n>` — only use match features (sets both feature sets).
- `-n, --namespace-string <n>` — force profile into namespace.
- `-X, --readimpliesX` — treat `r` flags as `mr` when READ_IMPLIES_EXEC is set.

### Caching control
- `-k, --show-cache` — report cache processing details.
- `-K, --skip-cache` — disable all caching (implies `-T`).
- `-T, --skip-read-cache` — skip loading from cache, but allow writing.
- `-W, --write-cache` — write cached profiles to cache location (default off).
- `--skip-bad-cache` — skip updating cache if it contains bad/inconsistent profiles.
- `-L, --cache-loc <dir>` — set cache directory (comma-separated list; first dir used for writes). Default: `/var/cache/apparmor`.
- `--print-cache-dir` — print the actual cache directory path.

### Execution control
- `-Q, --skip-kernel-load` — perform all actions except actual kernel load (no privilege needed).
- `-q, --quiet` — suppress loading reports and warnings.
- `-v, --verbose` — report profiles as loaded, show warnings.
- `--warn=<flag>` — enable specific warning (e.g., `rules-not-enforced`). Repeatable. Disable with `no-` prefix.
- `--Werror[=<flag>]` — convert warnings to errors. All warnings if no flag specified.
- `-d, --debug` — once: syntax check only; twice: dump interpretation.
- `-D, --dump=<flag>` — debug dump for various compilation stages. Repeatable.
- `-j, --jobs=<n>` — set parallel compilation jobs. `0` disables, `auto` for CPU count, `x#` scales.
- `--max-jobs <n>` — hard cap for `--jobs` scaling (default: 8*cpus).
- `-O, --optimize=<flag>` — set optimization flags. Repeatable.
- `--abort-on-error` — stop processing on first error.
- `--skip-bad-cache-rebuild` — do not rebuild cache on load failure.
- `--config-file <file>` — use alternate config file (default: `/etc/apparmor/parser.conf`).
- `--print-config-file` — print config file location.

### Config file
An optional config file `/etc/apparmor/parser.conf` can specify default options. Lines beginning with `#` are comments. Options are one per line using the long form (without `--`). Accumulating options like `Include`, `Dump`, `Optimize` can be specified multiple times; conflicting options override previous values.

## Examples
# Add a profile
apparmor_parser -a /etc/apparmor.d/usr.bin.foo

# Replace an existing profile
apparmor_parser -r /etc/apparmor.d/usr.bin.foo

# Remove a profile
apparmor_parser -R /etc/apparmor.d/usr.bin.foo

# Load in complain mode
apparmor_parser -C /etc/apparmor.d/usr.bin.foo

# Write binary cache to stdout
apparmor_parser -S /etc/apparmor.d/usr.bin.foo

# Skip caching and load
apparmor_parser -K /etc/apparmor.d/usr.bin.foo

# Verbose load
apparmor_parser -v /etc/apparmor.d/usr.bin.foo
## See Also
- [apparmor(7)](https://man7.org/linux/man-pages/man7/apparmor.7.html)
- [apparmor.d(5)](https://man7.org/linux/man-pages/man5/apparmor.d.5.html)
- [aa_change_hat(2)](https://man7.org/linux/man-pages/man2/aa_change_hat.2.html)
- AppArmor wiki: <https://wiki.apparmor.net>
- Bug reports: <https://gitlab.com/apparmor/apparmor/-/issues>