As abergman noticed, it might come from yast2-security package: https://github.com/yast/yast-security/blob/master/src/lib/y2security/lsm/app_armor.rb#L43