(For example) I want to restrict write access to /home/backup from anybody, except a particular backup script. (To protect from accidental deletion.) For this, I suppose, it is enough to have two ...
Can anyone possibly explain why Apparmor is not picking up profiles for sub-processes of a process? Right now we use God to launch an unstoppable Ruby process (in this case it's /usr/local/bin/remote) ...