[suse-security] Deny access to file for all applications with apparmor?

Hi, I was recently going through the manuals of apparmor. As far as I could understand you can create profiles for specific executables. I was wondering, however, is it possible to create a 'generic' profile that should be applied to ANY process started. Or, what I really want to accomplish, how can I deny access to specific file for ALL processes, except, let's say one or two? If I understand the concept right, this can't be done, but let me know if I am wrong, please! -- Blade hails you... Toll no bell for me father But let this suffering pass from me Send me no shepherd to heal my world But the Angel - the dream foretold --Nightwish