# apparmor_xattrs(7) - man - phpMan

[APPARMOR_XATTRS(7)](https://www.chedong.com/phpMan.php/man/APPARMORXATTRS/7/markdown)                            AppArmor                            [APPARMOR_XATTRS(7)](https://www.chedong.com/phpMan.php/man/APPARMORXATTRS/7/markdown)



## NAME
       apparmor_xattrs - AppArmor profile [xattr(7)](https://www.chedong.com/phpMan.php/man/xattr/7/markdown) matching

## DESCRIPTION
       AppArmor profiles can conditionally match files based on the presence and value of extended
       attributes in addition to file path. The following profile applies to any file under
       "/usr/bin" where the "security.apparmor" extended attribute has the value "trusted":

               profile trusted /usr/bin/* xattrs=(security.apparmor="trusted") {
                       # ...
               }

       Note that "security.apparmor" and "trusted" are arbitrary, and profiles can match based on
       the value of any attribute.

       The xattrs value may also contain a path regex:

               profile trusted /usr/bin/* xattrs=(user.trust="tier/*") {

                       # ...
               }

       The [**getfattr**(1)](https://www.chedong.com/phpMan.php/man/getfattr/1/markdown) and [**setfattr**(1)](https://www.chedong.com/phpMan.php/man/setfattr/1/markdown) tools can be used to view and manage xattr values:

               $ setfattr -n 'security.apparmor' -v 'trusted' /usr/bin/example-tool
               $ getfattr --absolute-names -d -m - /usr/bin/example-tool
               # file: usr/bin/example-tool
               security.apparmor="trusted"

       The priority of each profile is determined by the length of the path, then the number of
       xattrs specified. A more specific path is preferred over xattr matches:

               # Highest priority, longest path.
               profile example1 /usr/bin/example-tool {
                       # ...
               }

               # Lower priority than the longer path, but higher priority than a rule
               # with fewer xattr matches.
               profile example2 /usr/** xattrs=(
                       security.apparmor="trusted"
                       user.domain="**"
               ) {
                       # ...
               }

               # Lowest priority. Same path length as the second profile, but has
               # fewer xattr matches.
               profile example2 /usr/** {
                       # ...
               }

       xattr matching requires the following kernel feature:

               /sys/kernel/security/apparmor/features/domain/attach_conditions/xattr

## KNOWN ISSUES
       AppArmor profiles currently can't reliably match extended attributes with binary values such
       as security.evm and security.ima. In the future AppArmor may gain the ability to match based
       on the presence of certain attributes while ignoring their values.

## SEE ALSO
       [**apparmor**(8)](https://www.chedong.com/phpMan.php/man/apparmor/8/markdown), **apparmor**___**[parser**(8)](https://www.chedong.com/phpMan.php/man/parser/8/markdown), [**apparmor.d**(5)](https://www.chedong.com/phpMan.php/man/apparmor.d/5/markdown), [**xattr**(7)](https://www.chedong.com/phpMan.php/man/xattr/7/markdown), [**aa-autodep**(1)](https://www.chedong.com/phpMan.php/man/aa-autodep/1/markdown), [**clean**(1)](https://www.chedong.com/phpMan.php/man/clean/1/markdown), [**auditd**(8)](https://www.chedong.com/phpMan.php/man/auditd/8/markdown),
       [**getfattr**(1)](https://www.chedong.com/phpMan.php/man/getfattr/1/markdown), [**setfattr**(1)](https://www.chedong.com/phpMan.php/man/setfattr/1/markdown), and <<https://wiki.apparmor.net>>.



AppArmor 3.0.4                               2025-08-15                           [APPARMOR_XATTRS(7)](https://www.chedong.com/phpMan.php/man/APPARMORXATTRS/7/markdown)