$ dpkg -L rsyslog | grep apparmor
/etc/apparmor.d
/etc/apparmor.d/disable
/etc/apparmor.d/local
/etc/apparmor.d/force-complain
/etc/apparmor.d/usr.sbin.rsyslogd