Apparmor denies the hassio-supervisor profiles

### Describe the issue you are experiencing

Since a few days, after rebooting my HomeAssistant instance installed in supervised mode, now I see continuous logs like these in dmesg:

```
[dom apr 19 23:19:29 2026] audit: type=1400 audit(1776633595.895:10718): apparmor="DENIED" operation="capable" profile="hassio-supervisor///usr/bin/git" pid=586509 comm="git" capability=24 capname="sys_resource"
[dom apr 19 23:19:29 2026] audit: type=1400 audit(1776633595.895:10719): apparmor="DENIED" operation="capable" profile="hassio-supervisor///usr/bin/git" pid=586509 comm="git" capability=21 capname="sys_admin"
[dom apr 19 23:19:29 2026] audit: type=1400 audit(1776633595.895:10720): apparmor="DENIED" operation="capable" profile="hassio-supervisor///usr/bin/git" pid=586510 comm="git" capability=24 capname="sys_resource"
[dom apr 19 23:19:29 2026] audit: type=1400 audit(1776633595.895:10721): apparmor="DENIED" operation="capable" profile="hassio-supervisor///usr/bin/git" pid=586510 comm="git" capability=21 capname="sys_admin"
[dom apr 19 23:19:29 2026] audit: type=1400 audit(1776633595.903:10722): apparmor="DENIED" operation="capable" profile="hassio-supervisor///usr/bin/git" pid=586516 comm="git" capability=24 capname="sys_resource"
[dom apr 19 23:19:29 2026] audit: type=1400 audit(1776633595.903:10723): apparmor="DENIED" operation="capable" profile="hassio-supervisor///usr/bin/git" pid=586516 comm="git" capability=21 capname="sys_admin"
[dom apr 19 23:19:29 2026] audit: type=1400 audit(1776633595.919:10724): apparmor="DENIED" operation="capable" profile="hassio-supervisor///usr/bin/git" pid=586513 comm="git" capability=24 capname="sys_resource"
[dom apr 19 23:19:29 2026] audit: type=1400 audit(1776633595.919:10725): apparmor="DENIED" operation="capable" profile="hassio-supervisor///usr/bin/git" pid=586513 comm="git" capability=21 capname="sys_admin"
[dom apr 19 23:19:29 2026] audit: type=1400 audit(1776633596.243:10726): apparmor="DENIED" operation="capable" profile="hassio-supervisor" pid=9226 comm="SyncWorker_5" capability=24 capname="sys_resource"
[dom apr 19 23:19:29 2026] audit: type=1400 audit(1776633596.243:10727): apparmor="DENIED" operation="capable" profile="hassio-supervisor" pid=9226 comm="SyncWorker_5" capability=21 capname="sys_admin"
[dom apr 19 23:20:48 2026] kauditd_printk_skb: 140 callbacks suppressed
[dom apr 19 23:20:48 2026] audit: type=1400 audit(1776633675.195:10868): apparmor="DENIED" operation="capable" profile="hassio-supervisor" pid=9227 comm="bash" capability=24 capname="sys_resource"
[dom apr 19 23:20:48 2026] audit: type=1400 audit(1776633675.195:10869): apparmor="DENIED" operation="capable" profile="hassio-supervisor" pid=9227 comm="bash" capability=21 capname="sys_admin"
[dom apr 19 23:20:48 2026] audit: type=1400 audit(1776633675.223:10870): apparmor="DENIED" operation="capable" profile="hassio-supervisor" pid=9227 comm="bash" capability=24 capname="sys_resource"
[dom apr 19 23:20:48 2026] audit: type=1400 audit(1776633675.223:10871): apparmor="DENIED" operation="capable" profile="hassio-supervisor" pid=9227 comm="bash" capability=21 capname="sys_admin"
[dom apr 19 23:20:48 2026] audit: type=1400 audit(1776633675.223:10872): apparmor="DENIED" operation="capable" profile="hassio-supervisor" pid=595903 comm="bash" capability=24 capname="sys_resource"
[dom apr 19 23:20:48 2026] audit: type=1400 audit(1776633675.223:10873): apparmor="DENIED" operation="capable" profile="hassio-supervisor" pid=595903 comm="bash" capability=21 capname="sys_admin"

```

### What type of installation are you running?

Home Assistant Supervised

### Which operating system are you running on?

Debian

### Steps to reproduce the issue

1. Install HA in supervised mode
2. install some App
3. watch the "dmesg" output

### Anything in the Supervisor logs that might be useful for us?

```txt
All AppArmor warnings in dmesg show up when Supervisor prints in its log:

2026-04-19 23:17:44.046 INFO (MainThread) [supervisor.updater] Fetching update data from https://version.home-assistant.io/stable.json
2026-04-19 23:19:55.888 INFO (MainThread) [supervisor.store.git] Update app /data/addons/git/d5369777 repository from https://github.com/music-assistant/home-assistant-addon
2026-04-19 23:19:55.888 INFO (MainThread) [supervisor.store.git] Update app /data/addons/core repository from https://github.com/home-assistant/addons
2026-04-19 23:19:55.889 INFO (MainThread) [supervisor.store.git] Update app /data/addons/git/a0d7b954 repository from https://github.com/hassio-addons/repository
2026-04-19 23:19:55.889 INFO (MainThread) [supervisor.store.git] Update app /data/addons/git/5c53de3b repository from https://github.com/esphome/home-assistant-addon
2026-04-19 23:19:55.897 INFO (MainThread) [supervisor.store.git] Update app /data/addons/git/ccab4aaf repository from https://github.com/blakeblackshear/frigate-hass-addons
2026-04-19 23:19:55.898 INFO (MainThread) [supervisor.store.git] Update app /data/addons/git/8bce8ef4 repository from https://github.com/jehy/hass-addons
2026-04-19 23:19:55.898 INFO (MainThread) [supervisor.store.git] Update app /data/addons/git/79957c2e repository from https://github.com/f18m/ha-addons-repo
2026-04-19 23:19:55.910 INFO (MainThread) [supervisor.store.git] Update app /data/addons/git/45df7312 repository from https://github.com/zigbee2mqtt/hassio-zigbee2mqtt
2026-04-19 23:19:55.916 INFO (MainThread) [supervisor.store.git] Update app /data/addons/git/15d21743 repository from https://github.com/thomasmauerer/hassio-addons
2026-04-19 23:19:55.917 INFO (MainThread) [supervisor.store.git] Update app /data/addons/git/234db91b repository from https://github.com/EverythingSmartHome/everything-presence-addons
2026-04-19 23:19:55.919 INFO (MainThread) [supervisor.store.git] Update app /data/addons/git/c7744bff repository from https://github.com/arnonym/ha-plugins
2026-04-19 23:19:55.925 INFO (MainThread) [supervisor.store.git] Update app /data/addons/git/db21ed7f repository from https://github.com/alexbelgium/hassio-addons
2026-04-19 23:19:55.928 INFO (MainThread) [supervisor.store.git] Update app /data/addons/git/89275b70 repository from https://github.com/sdesalve/hassio-addons
```

### System information

## System Information

version | core-2026.4.3
-- | --
installation_type | Home Assistant Supervised
dev | false
hassio | true
docker | true
container_arch | amd64
user | root
virtualenv | false
python_version | 3.14.2
os_name | Linux
os_version | 6.1.0-44-amd64
arch | x86_64
timezone | Europe/Rome
config_dir | /config

Home Assistant Community Store

GitHub API | ok
-- | --
GitHub Content | ok
GitHub Web | ok
HACS Data | ok
GitHub API Calls Remaining | 5000
Installed Version | 2.0.5
Stage | running
Available Repositories | 2939
Downloaded Repositories | 20

Home Assistant Cloud

logged_in | false
-- | --
can_reach_cert_server | ok
can_reach_cloud_auth | ok
can_reach_cloud | ok

Home Assistant Supervisor

host_os | Debian GNU/Linux 12 (bookworm)
-- | --
update_channel | stable
supervisor_version | supervisor-2026.04.0
agent_version | 1.6.0
docker_version | 29.4.0
disk_total | 30.2 GB
disk_used | 14.2 GB
nameservers | 1.0.0.1
healthy | true
supported | failed to load: Unsupported
host_connectivity | true
supervisor_connectivity | true
ntp_synchronized | true
virtualization |
supervisor_api | ok
version_api | ok
installed_addons | AdGuard Home (6.1.2), Mosquitto broker (7.0.1), Samba share (12.5.4), chrony (6.0.1), SQLite Web (6.0.1), DbStats (0.5.12), Dnsmasq-DHCP (5.0.1), ha-sip (5.5), VOIP Client (1.0.0), Terminal & SSH (10.1.0), VOIP Client BETA (beta), Frigate (0.17.1), ESPHome Device Builder (2026.4.0), Everything Presence Zone Configurator (2.0.12), Zigbee2MQTT (2.9.2-1), Matter Server (8.4.0), Dnsmasq-DHCP BETA (beta)

Dashboards

dashboards | 15
-- | --
resources | 8
views | 32
mode | storage

Network Configuration

adapters | lo (disabled), enp1s0 (enabled, default, auto), enp2s0 (enabled), tailscale0 (disabled), br-593887fedad8 (disabled), br-6a23122dde37 (disabled), hassio (disabled), br-884875338f74 (disabled), br-b77c6d626ce3 (disabled), br-0c1fa4db5766 (disabled), br-329162324b8d (disabled), br-bf3e83069dea (disabled), br-42d13a3bd822 (disabled), br-8a060463cc7c (disabled), br-f6adc4848704 (disabled), br-833ea14cb1eb (disabled), br-ac49fae20c29 (disabled), docker0 (disabled), br-27b369ce9112 (disabled), br-69ff096fd3d6 (disabled), br-24b3f685c8ab (disabled), veth99dd7b2 (disabled), veth3fba7a9 (disabled), veth6c7e976 (disabled), vethaf71a7a (disabled), vethf220324 (disabled), veth42db9df (disabled), vethadc4610 (disabled), veth4c4b048 (disabled), veth0f70634 (disabled), veth52e644d (disabled), vethc2db2ec (disabled), vethf14d823 (disabled), vethed408ac (disabled), veth8f1e224 (disabled), vethb3ecd33 (disabled), vethf66a6f7 (disabled), vethec1b61c (disabled), veth5c7d2ca (disabled), veth91fc11c (disabled), veth50a8dec (disabled), vethfcde750 (disabled), veth2575dc7 (disabled), veth87481fa (disabled), vethf9433c2 (disabled), veth5d10687 (disabled), vethbfe88f6 (disabled), vethc61dfaf (disabled), veth3edc7aa (disabled), veth7dddbae (disabled), veth2a76db1 (disabled), veth75f50df (disabled), veth2dcf3dc (disabled), veth3cf6511 (disabled), vetha73fbc1 (disabled), veth986a2b1 (disabled), veth681e55f (disabled), vethfb77406 (disabled), veth5f39f79 (disabled), vetha089f67 (disabled), vethde63857 (disabled), veth6b07ed8 (disabled), veth617bab9 (disabled), veth37fd2c3 (disabled), veth38a6e94 (disabled), veth4a06b05 (disabled), veth9bbc225 (disabled), vethe5b35e6 (disabled), vethbe09657 (disabled), vethf102e99 (disabled), vethcf8502a (disabled), veth88c1f03 (disabled), veth17ec19a (disabled), veth7d56a3b (disabled)
-- | --
ipv4_addresses | lo (127.0.0.1/8), enp1s0 (192.168.1.8/24), enp2s0 (192.168.2.8/24), tailscale0 (100.126.234.105/32), br-593887fedad8 (172.23.0.1/16), br-6a23122dde37 (172.26.0.1/16), hassio (172.30.32.1/23), br-884875338f74 (192.168.16.1/20), br-b77c6d626ce3 (172.27.0.1/16), br-0c1fa4db5766 (172.29.0.1/16), br-329162324b8d (172.20.0.1/16), br-bf3e83069dea (172.19.0.1/16), br-42d13a3bd822 (172.22.0.1/16), br-8a060463cc7c (192.168.32.1/20), br-f6adc4848704 (172.24.0.1/16), br-833ea14cb1eb (172.21.0.1/16), br-ac49fae20c29 (172.18.0.1/16), docker0 (172.17.0.1/16), br-27b369ce9112 (172.25.0.254/24), br-69ff096fd3d6 (172.28.0.1/16), br-24b3f685c8ab (172.31.0.1/16), veth99dd7b2 (), veth3fba7a9 (), veth6c7e976 (), vethaf71a7a (), vethf220324 (), veth42db9df (), vethadc4610 (), veth4c4b048 (), veth0f70634 (), veth52e644d (), vethc2db2ec (), vethf14d823 (), vethed408ac (), veth8f1e224 (), vethb3ecd33 (), vethf66a6f7 (), vethec1b61c (), veth5c7d2ca (), veth91fc11c (), veth50a8dec (), vethfcde750 (), veth2575dc7 (), veth87481fa (), vethf9433c2 (), veth5d10687 (), vethbfe88f6 (), vethc61dfaf (), veth3edc7aa (), veth7dddbae (), veth2a76db1 (), veth75f50df (), veth2dcf3dc (), veth3cf6511 (), vetha73fbc1 (), veth986a2b1 (), veth681e55f (), vethfb77406 (), veth5f39f79 (), vetha089f67 (), vethde63857 (), veth6b07ed8 (), veth617bab9 (), veth37fd2c3 (), veth38a6e94 (), veth4a06b05 (), veth9bbc225 (), vethe5b35e6 (), vethbe09657 (), vethf102e99 (), vethcf8502a (), veth88c1f03 (), veth17ec19a (), veth7d56a3b ()
ipv6_addresses | lo (::1/128), enp1s0 (fe80::72ab:c5c4:e718:9666/64), enp2s0 (fe80::a8a1:ebe9:c753:23f2/64), tailscale0 (fd7a:115c:a1e0::9901:ea6a/128, fe80::d308:1e52:5d60:37fe/64), br-593887fedad8 (fe80::e4b7:eaff:fea3:b13a/64), br-6a23122dde37 (fe80::80ab:5aff:fe66:84c9/64), hassio (fd0c:ac1e:2100::1/48, fe80::cc44:c9ff:fed3:f51/64), br-884875338f74 (fe80::30a0:f0ff:febd:17c/64), br-b77c6d626ce3 (fe80::3c4d:fcff:fe0a:eba4/64), br-0c1fa4db5766 (fe80::6c38:e4ff:feac:632b/64), br-329162324b8d (fe80::5c52:67ff:fed9:73b5/64), br-bf3e83069dea (fe80::f036:1dff:fe90:4d5b/64), br-42d13a3bd822 (fe80::3c6c:9aff:fe87:5325/64), br-8a060463cc7c (fe80::cfc:4bff:fe0e:5c55/64), br-f6adc4848704 (fe80::f02d:a6ff:fe62:3847/64), br-833ea14cb1eb (fe80::2c7e:3bff:fe5e:ec81/64), br-ac49fae20c29 (fe80::1050:fff:fe82:1d2d/64), docker0 (fe80::805c:deff:febc:1959/64), br-27b369ce9112 (fe80::ecc7:5aff:fe8b:83dc/64), br-69ff096fd3d6 (fe80::c00:56ff:fe24:6f18/64), br-24b3f685c8ab (fe80::2897:3fff:fe56:6a11/64), veth99dd7b2 (fe80::18a1:9ff:fe85:e519/64), veth3fba7a9 (fe80::f4ed:87ff:fef7:761f/64), veth6c7e976 (fe80::a043:4eff:febf:5122/64), vethaf71a7a (fe80::7c2e:aaff:fee7:82ae/64), vethf220324 (fe80::c460:5eff:fe30:47e7/64), veth42db9df (fe80::24d3:46ff:fe71:d3c7/64), vethadc4610 (fe80::f4e7:d6ff:fe30:54a0/64), veth4c4b048 (fe80::7823:1ff:fe99:6e56/64), veth0f70634 (fe80::bc9d:44ff:febe:500d/64), veth52e644d (fe80::a4fe:bcff:fe94:8060/64), vethc2db2ec (fe80::b4c8:8dff:fe2f:fe1d/64), vethf14d823 (fe80::9024:7dff:fedf:efa/64), vethed408ac (fe80::b0ac:ffff:fec4:d022/64), veth8f1e224 (fe80::6cba:72ff:fe91:42c7/64), vethb3ecd33 (fe80::94a1:5dff:fe70:ff51/64), vethf66a6f7 (fe80::2859:a3ff:fec6:db8b/64), vethec1b61c (fe80::d402:18ff:fee4:39dc/64), veth5c7d2ca (fe80::9876:92ff:fee6:fc7e/64), veth91fc11c (fe80::7cf7:c5ff:fe4c:eb5c/64), veth50a8dec (fe80::54ec:1dff:fe07:be96/64), vethfcde750 (fe80::98be:c6ff:fe2d:5a80/64), veth2575dc7 (fe80::4474:ecff:febc:6b3e/64), veth87481fa (fe80::948a:63ff:fed0:3ed9/64), vethf9433c2 (fe80::5443:9aff:fe45:aec5/64), veth5d10687 (fe80::fc07:a7ff:fed3:1463/64), vethbfe88f6 (fe80::fc7b:34ff:feef:d00c/64), vethc61dfaf (fe80::e03f:ffff:fe50:1380/64), veth3edc7aa (fe80::a409:75ff:feaa:b513/64), veth7dddbae (fe80::58bd:12ff:fe29:5d8b/64), veth2a76db1 (fe80::e8ff:9aff:fecc:94b7/64), veth75f50df (fe80::b4e4:b1ff:fed6:3b0d/64), veth2dcf3dc (fe80::4c45:aff:fe25:3ce3/64), veth3cf6511 (fe80::accb:5eff:fead:3d1b/64), vetha73fbc1 (fe80::38ce:ff:fe70:cd0d/64), veth986a2b1 (fe80::c23:d1ff:fe6f:455b/64), veth681e55f (fe80::6c95:c4ff:fe1b:a635/64), vethfb77406 (fe80::485c:4aff:fe89:a70c/64), veth5f39f79 (fe80::8073:7aff:fe24:8f6f/64), vetha089f67 (fe80::887b:4aff:feaa:cf79/64), vethde63857 (fe80::476:7aff:fed7:8753/64), veth6b07ed8 (fe80::803f:67ff:fe9b:eef9/64), veth617bab9 (fe80::545e:12ff:fe2a:9f4b/64), veth37fd2c3 (fe80::54fc:27ff:fe00:7cd7/64), veth38a6e94 (fe80::1c92:5ff:fef3:2269/64), veth4a06b05 (fe80::60ed:4aff:fed7:4a47/64), veth9bbc225 (fe80::bc9d:21ff:fe48:58cc/64), vethe5b35e6 (fe80::f8ad:8dff:feb1:936f/64), vethbe09657 (fe80::4ce:8eff:fe15:7da3/64), vethf102e99 (fe80::2c51:1aff:feb1:e94c/64), vethcf8502a (fe80::341e:aeff:feb2:ad2b/64), veth88c1f03 (fe80::701c:8bff:feb9:e6e9/64), veth17ec19a (fe80::981f:daff:fe7f:ffbe/64), veth7d56a3b (fe80::d083:5cff:fe88:d95a/64)
announce_addresses | 192.168.1.8, fe80::72ab:c5c4:e718:9666, 192.168.2.8, fe80::a8a1:ebe9:c753:23f2

Recorder

oldest_recorder_run | March 29, 2026 at 7:48 AM
-- | --
current_recorder_run | April 18, 2026 at 1:15 AM
estimated_db_size | 1771.14 MiB
database_engine | sqlite
database_version | 3.49.2

Sonoff

version | 3.11.1 (66624ed)
-- | --
cloud_online | 1 / 1
local_online | 1 / 1

### Supervisor diagnostics

_No response_

### Additional information

_No response_

Start by reproducing the reported AppArmor denials with a supervised installation on Debian, then compare dmesg output with the Supervisor log entries during app and repository updates. The report names no source file or test; done means determining why the hassio-supervisor profiles deny the listed capabilities and confirming the warnings no longer recur without breaking Supervisor operations.

Written by the indexing model from the issue text.