# User Armor: An Extension for AppArmor
## 4 Literature Review  
The closest work to our proposal is Paranoid Penguin [5], which introduces an extension of AppArmor primarily aimed at improving usability. The main contribution of Paranoid Penguin is the integration of a graphical user interface (GUI) to facilitate the creation, modification and management of AppArmor profiles. This approach makes AppArmor more accessible to users who may not be familiar with its command-line tools, lowering the barrier to entry for system administrators and security practitioners. The GUI provides an intuitive way to define and enforce security policies without requiring deep knowledge of the syntax used by AppArmor, reducing the risk of misconfigurations that could compromise security. While Paranoid Penguin enhances the usability of AppArmor, it does not extend or modify the underlying security enforcement model. That is, the access control mechanism itself remains unchanged, and security policies are still applied in the same way as in standard AppArmor. Stated differently, the framework does not introduce new functionalities for improving security beyond profile simplification. In contrast, UserArmor goes beyond usability improvements by introducing two key enhancements to the core security model of AppArmor. First, UserArmor allows binding security profiles to specific users, ensuring fine-grained access control in multi-user environments. Traditional AppArmor applies profiles at the application level, meaning that all users executing the same process are subject to the same restrictions. This limitation can lead to security gaps, as different users may require different levels of access to resources. UserArmor addresses this by associating distinct subprofiles with individual users, ensuring that permissions are customized per user rather than being uniformly applied to all instances of an application. Second, UserArmor introduces an inheritance system for policy rules, which improves policy management and scalability. In standard AppArmor, profiles must explicitly define all required permissions, leading to redundancy when multiple profiles share common rules. While AppArmor provides a mechanism called abstractions to group reusable rules, these operate by an all-or-nothing inclusion, meaning administrators cannot selectively inherit only specific rules from an abstraction. UserArmor solves this problem by introducing a tag-based inheritance mechanism, where profiles can inherit only the necessary rules, reducing duplication and simplifying policy maintenance. By addressing these limitations, UserArmor extends the capabilities of AppArmor beyond usability enhancements and introduces structural improvements that make it more suitable for multi-user environments and dynamic security policies. Stateddifferently, while Paranoid Penguin provides a more user-friendly interface for AppArmor, UserArmor fundamentally improves its security model by enabling user-specific policy enforcement and hierarchical policy inheritance, making it a more flexible and scalable solution for access control in modern Linux systems. A broader area of research focuses on dynamic profiling to enhance security at runtime. These approaches monitor application behavior and adaptively adjust permissions, allowing for more flexible and responsive access control. Unlike traditional security policies, which are static and predefined, dynamic profiling mechanisms observe how applications interact with system resources and adjust security policies accordingly to mitigate risks. One branch of research explores cloud-based profile generation, as seen in [13; 14], where profile management is offloaded to Cloud Services. This approach offers greater flexibility and scalability, as security policies can be updated dynamically based on centralized monitoring and threat detection. On the other hand, some solutions are designed to run directly on the operating system, ensuring real-time policy enforcement at the local level [15].