I've had to create apparmour profiles in the past. There is some good tooling, but it's still not trivial.