anchor.diff:  
       permit_device_control
       create_loop_devices 256
  -    setup_apparmor
  +
  +    <% if p("garden.apparmor_profile") == "garden-default" %>
  +      load_apparmor_profile "$GARDEN_CONFIG_DIR"/garden-default
  +    <% end %>
  +
       set_graph_permissions "$graph_path"
   
       echo 1 > /proc/sys/kernel/dmesg_restrict
  
positive.code:   done
  }
  
  function setup_apparmor() {
    local default_policy=garden-default
    export PATH=$PATH:$(readlink -nf /var/vcap/packages/apparmor/bin)
    POLICY=<%= p("garden.apparmor_profile") %>
    CONFIG_DIR=/var/vcap/jobs/garden/config
  
    if ! mountpoint -q /sys/kernel/security; then
      mount -t securityfs securityfs /sys/kernel/security
    fi
  
    if ! aa-status | grep $default_policy > /dev/null; then
      apparmor_parser -a $CONFIG_DIR/$default_policy
    fi
  }
  
  function set_graph_permissions() {
  
negative.code:     <% p("garden.additional_dns_servers").each do |server| %> \
        --additional-dns-server=<%= server %> \
      <% end %> \
      <% if !p("garden.apparmor_profile").empty? %> \
        --apparmor=<%= p("garden.apparmor_profile") %> \
      <% end %> \
      <% if p("garden.cleanup_process_dirs_on_wait") %> \
  