debian/patches/001_apparmor_profile.patch already adds
+ @{PROC}/@{pid}/net/ip_tables_names r,
+ /usr/sbin/xtables-nft-multi rix,so 002_apparmor_profile.patch that adds the following + /etc/host.conf r, + /etc/resolv.conf r, + /etc/services r, + /run/resolvconf/resolv.conf r, + /sbin/ipset rix, + /usr/sbin/ipset rix, should work for the ipset use case -- Luca Filipozzi
