AppArmor profile

A file in /etc/apparmor.d listing what a program may do: paths with r, w, x rights and capabilities. In enforce mode the kernel denies the rest and logs apparmor="DENIED"; in complain mode it only logs.