AA-EXEC(1) AppArmor AA-EXEC(1) (NAME) aa-exec - AppArmor (SYNOPSIS) aa-exec [] [--] [<> ...] (DESCRIPTION) aa-exec (namespace) . . . ( aa-exec ). <> aa-exec -- aa-exec : aa-exec -p profile1 -- ls -l (OPTIONS) aa-exec : -p PROFILE, --profile=PROFILE <> PROFILE. PROFILE ( unconfined) . -n NAMESPACE, --namespace=NAMESPACE NAMESPACE. . -i, --immediate PROFILE <>. <> exec . -v, --verbose . -d, --debug . -- . -- . <> aa-exec . (RESTRICTIONS) aa-exec aa_change_profile(3) . aa_change_profile(3) . aa-exec (unconfined) . (unprivileged unconfined restriction) : https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_unconfined_restriction (STACKING) aa-exec . . . . . exec (canonicalized) . //& . : $ aa-exec -p "unconfined//&firefox" -- bash $ ps -Z LABEL PID TTY TIME CMD unconfined 30714 pts/12 00:00:00 bash firefox//&unconfined (unconfined) 31160 pts/12 00:00:00 bash firefox//&unconfined (unconfined) 31171 pts/12 00:00:00 ps (NAMESPACES) aa-exec (policy namespace) . . (access denial) . : . : $ aa-exec -p :ex1:unconfined -- bash $ ps -Z LABEL PID TTY TIME CMD - 30714 pts/12 00:00:00 bash unconfined 34372 pts/12 00:00:00 bash unconfined 34379 pts/12 00:00:00 ps - . . . : $ ps -Z 34372 LABEL PID TTY STAT TIME COMMAND :ex1:unconfined 34372 pts/12 S+ 0:00 bash : $ aa-exec -p "unconfined//&:ex1:unconfined" -- bash $ ps -Z LABEL PID TTY TIME CMD - 30714 pts/12 00:00:00 bash unconfined 36298 pts/12 00:00:00 bash unconfined 36305 pts/12 00:00:00 ps : $ ps -Z 36298 LABEL PID TTY STAT TIME COMMAND unconfined//&:ex1:unconfined 36298 pts/12 S+ 0:00 bash (BUGS) : (SEE ALSO) apparmor(7) apparmor.d(5) aa_change_profile(3) aa_change_onexec(3) . AppArmor 4.1.7 2026-03-10 AA-EXEC(1)