Creating a custom AppArmor profile
This demo creates an Apparmor profile for a mono (.NET) application which downloads a file from the Internet.
After generating the profile with aa-genprof (apt install apparmor-utils), the profile is tuned to only allow the download of the httpserver.py file somewhere in de homedirectory of any user (even the root user)
I used key-mon (sudo apt install key-mon) to capture my keystrokes