When install and enforce default profiles have message after aa-unconfined about /sbin/dhclient not confined. Copy profile for it from additional apparmor  profiles
"sbin.dhclient". After restart nothing is changed and aa-unconfined returns same messages. After attempt to enable it by aa-enforce /sbin/dhclient get error "ERROR: /etc/apparmor.d/sbin.dhclient contains no profile" while sbin.dhclient is actually in apparmor profiles folder.