DH_APPARMOR(1)

📦
version 6.0.0~alpha1 · 13 versions
, in ubuntu stonking

💖 DH_APPARMOR 💖

okay bestie, so this is dh_apparmor, and yes it's part of the Debhelper manual crew, and yes it's about to make your AppArmor profiles behave 💅

✨ NAME ✨

dh_apparmor — reload that AppArmor profile and make the local include file, fr fr

🎀 SYNOPSIS 🎀

dh_apparmor [--manifest=manifestfile] --profile-name=profilename

🦋 DESCRIPTION 🦋

so dh_apparmor is a debhelper program, and what it does is create/remove the /etc/apparmor.d/local/<profilename> include file inside your maintainer scripts. lowkey essential.

it also reloads the specified AppArmor profile in postinst, using this exactly:

apparmor_parser -r -W -T /etc/apparmor.d/<profilename>

and the reason we pass '-W -T' is so that any abstraction updates get pulled in too. no cap, that's the whole point 🫶

🔥 OPTIONS 🔥

  • --profile-name=<profilename> — tell it the profile name. like, for example:
dh_apparmor --profile-name=bin.foo
dh_apparmor --profile-name=bin.foo -p foo
  • --manifest=<manifestfile> — optionally hand it a manifest file. when you do, a profile gets generated by calling aa-easyprof(8) with the manifest file you gave it, and the resulting profile gets dropped into debian/apparmor/<profilename>. for example, if there's a valid manifest sitting in debian/manifest.json, then this next command will create debian/apparmor/bin.bar for the <bar> package:
dh_apparmor --manifest=manifest.json --profile-name=bin.bar -p bar
⚠️ heads up bestie: you will need to clean this up yourself via override_dh_clean or something similar. it does not clean itself. it's giving main character, not giving self-sufficient 😭

and because not every build environment supports the apparmor kernel interface, aa-easyprof(8) gets called with the --no-verify option. using this option requires that apparmor-utils is installed, periodt.

🌸 NOTES 🌸

when you're doing modern dh packaging techniques, you can add dh_apparmor into the override_dh_install section of the rules file. iconic.

but listen — if your package has multiple binary packages, you're gonna want to pass '-p<package name>' to dh_apparmor, otherwise dh_apparmor will add AppArmor reload commands for all the packages instead of just the one that actually ships the profile. don't do that to yourself 🙈

in addition, you will have to install the profile itself in /etc/apparmor.d. eg, in the manifest file example up above, if you're using dh_install you'd add this to debian/bar.install:

debian/apparmor/bin.bar etc/apparmor.d

👑 SEE ALSO 👑

debhelper(7) aa-easyprof(8)

this program is a part of debhelper. 💜

🌈 AUTHOR 🌈

Jamie Strandboge <jamie@canonical.com>

okay that's the whole vibe check, bestie — and just so you have the receipts: this was 6.0.0~alpha1-0ubuntu4, dated 2026-10-05, and you read the DH_APPARMOR(1) page in full. slay 💅✨

📦 where this page comes from