# cat /etc/debian_version
10.13

# cat /etc/apparmor.d/tunables/home.d/yyy
@{HOMEDIRS}+=/home/global/


systemctl reload apparmor
# works as expected and also enables the modified HOMEDIRS stuff.


# aa-disable usr.bin.thunderbird
ERROR: Values added to a non-existing variable
    @{HOMEDIRS}: /home/global/ in tunables/home.d/yyy

and it will not disable the profile.
aa-enforce also won't work.

it seems like the normal apparmor system works with HOMEDIRS correctly
but the apparmor-utils don't.

this may be linked to
https://bugs.launchpad.net/apparmor/+bug/1331856



cya
Erik

Hello,

Am Mittwoch, 23. November 2022, 15:58:30 CET schrieb Erik Thiele:

Indeed, and the relevant part is comment 16:

    This bug is finally fixed with
https://gitlab.com/apparmor/apparmor/-/merge_requests/544

    AppArmor 3.0 will include the fixed tools.

Unfortunately you / your Debian version still have 2.13.x, and the merge
request is too big to backport it to the 2.13 branch.

As long as you stay with AppArmor 2.13.x and want to use the aa-* tools,
the workaround is to edit   /etc/apparmor.d/tunables/home   instead of
using a home.d/ file to extend a variable with   +=


Regards,

Christian Boltz

Magic is just another word for indistinguishable advanced technology :D
[> Bruno Friedmann and Jan Engelhardt in opensuse-factory]