How does AppArmor provide application security?

AppArmor provides application security through mandatory access control using security profiles that define what resources applications can access.
Key mechanisms:

• Path-based access control: Controls access based on file paths
• Capability restrictions: Limits system capabilities processes can use
• Network access control: Restricts network operations
• Resource limitations: Controls memory, file descriptors, etc.
  AppArmor profiles define:

# Example profile snippet
/usr/bin/firefox {
  /home/*/** r,           # Read access to user files
  /tmp/** rw,             # Read/write to temp
  capability net_bind_service,  # Network capability
  deny /etc/shadow r,     # Explicitly deny access
}

Applications run confined within their profiles, preventing unauthorized access even if compromised.