ah, ssh. I think it's possible to have sub profiles in apparmor. maybe that makes sense with ssh