Could software be made that automatically creates AppArmor profiles by scanning source code? If so, how effective would the profiles be?

I think that would be possible; its effectiveness not warranted to be hundred percent, it might be less.

I'd say it'd be less accurate and even if it weren't less accurate you don't want the software be allowed to do everything it theoretically could do. What would work would be looking at the specifications, if there are any, or figuring them out otherwise. Then take the intersection of that with what you want limit the program to. Right now AppArmor is primarily limited to controlling file system access. The networking access control is currently a feeble on or off choice and cannot decide on ports etc. For that you might have options using specific groups for specific programs and then using NFTables to control what that group can use on the network.

1 members found this post helpful.