[Query] How to extend on top of the default apparmor profile?

[DilanUA]

Hi Team,

I am expecting to extend the default apparmor profile with few other custom rules.
My initial idea was that the default profile is loaded via a file based definition of the profile, so that
I can take a copy of that file, update the profile and reload it via the apparmor_parser as described in apparmor docs
for loading new profiles.

But upon further investigation, I understood that it's loaded at realtime by Containerd runtime via a code segment in
https://github.com/containerd/containerd/blob/main/contrib/apparmor/template.go#L132C3-L132C3.
So, in this case, what possibility is there to extend on top of this?
Is this a supported feature or not ?

@crosbymichael @Random-Liu @dmcgowan

Thanks.