diff --git a/modules/apparmor.nix b/modules/apparmor.nix
new file mode 100644
index 0000000..fddd363
--- /dev/null
+++ b/modules/apparmor.nix
@@ -0,0 +1,36 @@
+{ pkgs, system, username, config, ... }: {
+  config = {
+    security.apparmor = {
+      enable = true;
+
+      packages = [ pkgs.apparmor-profiles ];
+
+      killUnconfinedConfinables = true;
+
+      policies = {
+        # TODO: Refactor this into a directory, ideally we'll have too many
+        # profiles for this to be just here. Perhaps look at neovim for an
+        # example? Explore if we could put these outside of nix files so we can
+        # use syntax highlighting
+
+        default_deny = {
+          profile = ''
+          profile default_deny /** { }
+          '';
+          enforce = false;
+          enable = true;
+        };
+
+        sudo = {
+          profile = ''
+          ${config.security.wrapperDir}/sudo {
+            file rwlkUx,
+          }
+          '';
+        };
+      };
+    };
+
+    services.dbus.apparmor = "required";
+  };
+}