Public bug reported:
1) Ubuntu 26.04
2) 5.0.2-0ubuntu1~26.04.1
3) Add a system-tray indicator for AppArmor that surfaces security-relevant
events (new crontab entries, reverse-shell patterns, profile violations) with
allow/block actions and a protected alert log.
Summary
Provide a persistent system-tray icon for AppArmor that notifies users of
important security events in real time. The icon would display a chronological
log of alerts, offer per-event Allow/Block (or “add exception”) actions, and
restrict log-clearing to superuser (or a polkit-authorized user). This closes
the current visibility gap where AppArmor denials and related system changes
(crontab modifications, unexpected network listeners) are largely silent to the
average desktop user.
Problem / Motivation
AppArmor currently logs denials to the audit/journal subsystem, but most users
never see them. Malware or a compromised process can:
• Silently add or modify crontab entries
• Spawn a reverse shell
• Trigger profile violations that look like privilege-escalation attempts
…with little or no interactive feedback. Existing tools such as aa-notify only
produce transient desktop notifications and lack a persistent indicator,
historical log view, or interactive allow/block workflow. Application firewalls
like OpenSnitch provide a tray experience, but they focus on network
connections rather than AppArmor profiles or local system-integrity events.
A tray icon with actionable alerts would bring AppArmor closer to the usability
of modern endpoint-protection tools while remaining true to its
mandatory-access-control model.
Proposed Solution
1. Tray icon states
• Quiet / green
• Pending alerts / yellow
• Critical events (reverse shell, unexpected crontab change,
high-severity denial) / red
2. Event sources (monitored by a privileged helper)
• AppArmor audit/denial events
• Changes to system and user crontabs (/etc/crontab, /var/spool/cron/,
etc.)
• Suspicious process behavior suggestive of reverse shells (new
listening sockets, unexpected outbound connections from interpreters, etc.)
• Profile load/unload or mode-change events
3. User interface
• Click the icon → chronological list of recent alerts
• Per-alert actions: Allow (temporary or permanent exception), Block,
View related profile, Open journal entry
• Only a superuser (or a user granted a specific polkit privilege) may
clear the log or permanently silence an alert class
4. Security requirements
• Tray applet runs as the logged-in user
• Decision engine, log storage, and clearing operations run in a
privileged helper (polkit-activated service or capability-restricted binary)
• Alert log is append-only and integrity-protected so an attacker
cannot erase their own traces
Benefits
• Dramatically improves user awareness of AppArmor activity
• Enables quick, informed decisions (allow legitimate new behavior or block
suspicious activity)
• Makes crontab and reverse-shell detection visible without requiring users to
read journalctl
• Complements existing tools (aa-notify, OpenSnitch, auditd) rather than
replacing them
• Encourages broader adoption of AppArmor on desktop systems by reducing its
“silent” character
Possible Implementation Notes
• Extend or re-use the existing aa-notify infrastructure
• Prefer a D-Bus interface between a privileged daemon and a lightweight
Qt/GTK tray applet
• Use inotify for crontab directories and eBPF/audit rules for process/network
heuristics
• Ship as an optional package (e.g. apparmor-notify-tray) so distributions can
decide default enablement
4) No AppArmor system tray icon.
** Affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170303
Title:
Feature Request: AppArmor System Tray Icon with Security Notifications
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2170303/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
