AppArmor: when the profile denies access

The refusal is written to the kernel log. The apparmor="DENIED" line names the profile, the action and the path (all fields):

apparmor="DENIED" operation="open" requested_mask="r"
profile="/usr/local/bin/docsrv"
name="/srv/docs/index.html"

profile is whose profile it is, operation and requested_mask are what the program tried to do (r to read, w to write), name is which path. From this you can see which path to add to the profile.

You do not touch the package profile itself — an update overwrites it. The needed paths are added to /etc/apparmor.d/local/<profile name>: the profile pulls this file in with the line include if exists <local/...>, and an update leaves it alone. A rule line is a path and permissions:

echo '/srv/docs/** r,' \
  | sudo tee /etc/apparmor.d/local/usr.local.bin.docsrv
# reload the profile
sudo apparmor_parser -r /etc/apparmor.d/usr.local.bin.docsrv

r is read, w is write, /srv/docs/** is every file under the directory. The directory itself — the list of its files — is not opened by the ** rule: it needs its own line, /srv/docs/ r, (in the Wiki). apparmor_parser -r reloads the profile, and the rule takes effect at once, including for a running process. You add exactly the paths needed: the profile must keep everything else closed.