apparmor profile change forensic analyzer — free browser tool | fatcousin

drop apparmor profile dir + audit · parse profile transitions · runs locally

input

drop apparmor profiles · audit.log · aa-status · journal snippets

or click

Select file

profiles from /etc/apparmor.d · DENIED/ALLOWED audit lines · aa-status · journalctl apparmor entries

limits

heuristic screener · profile syntax varies by distro · not definitive proof

status

>ready