Edit: /etc/apparmor.d/ipa_verify (351B)
# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"
abi
,
include
profile ipa_verify /usr/bin/ipa_verify flags=(unconfined) {
userns,
# Site-specific additions and overrides. See local/README for details.
include if exists
}