FM / tunables

/etc/apparmor.d/tunables

Name	Size	Mode	Actions
home.d/	-	0755	rm
multiarch.d/	-	0755	rm
xdg-user-dirs.d/	-	0755	rm
alias	624	0644	edit dl rm
apparmorfs	375	0644	edit dl rm
dovecot	804	0644	edit dl rm
etc	1077	0644	edit dl rm
global	785	0644	edit dl rm
home	982	0644	edit dl rm
kernelvars	1391	0644	edit dl rm
multiarch	630	0644	edit dl rm
proc	440	0644	edit dl rm
run	23	0644	edit dl rm
securityfs	405	0644	edit dl rm
share	819	0644	edit dl rm
sys	378	0644	edit dl rm
system	5055	0644	edit dl rm
xdg-user-dirs	867	0644	edit dl rm

Edit: /etc/apparmor.d/tunables/kernelvars (1391B)

#    Copyright (C) 2012 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

# This file should contain declarations to kernel vars or variables
# that will become kernel vars at some point

# until kernel vars are implemented
# and until the parser supports nested groupings like
#   @{pid}=[1-9]{[0-9]{[0-9]{[0-9]{[0-9]{[0-9],},},},},}
# use
@{pid}={[1-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9]}

#same pattern as @{pid} for now
@{tid}=@{pid}

#A pattern for pids that can appear
@{pids}=@{pid}

# Placeholder for user id until kernel var is implemented to match
# current user of the confined application.
# Values are 0...4,294,967,295 (32-bit unsigned, 10 digits).
@{uid}={[0-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]}

#same pattern as @{uid} for now
@{uids}=@{uid}

# until kernel var is implemented
@{sys}=/sys/

cmd: