virt-aa-helper has (TBH misunderstandable) call modes for appending:
-f | --add-file <file> add file to profile
-F | --append-file <file> append file to profile
-f does render the XML into apparmor rules and then adds the passed file (this is used atm by the labelling call).
-F keeps the apparmor rules as-is and will add a new rule at the end.
By using -F this would work for the use case in discussion (tried it manually), but I will need to consider a bunch of other interactions if we change this.
virt-aa-helper has (TBH misunderstandable) call modes for appending:
-f | --add-file <file> add file to profile
-F | --append-file <file> append file to profile
-f does render the XML into apparmor rules and then adds the passed file (this is used atm by the labelling call).
-F keeps the apparmor rules as-is and will add a new rule at the end.
By using -F this would work for the use case in discussion (tried it manually), but I will need to consider a bunch of other interactions if we change this.