diff -ur pure-ftpd-1.0.40.org/config.h.in pure-ftpd-1.0.40/config.h.in
--- pure-ftpd-1.0.40.org/config.h.in	2015-06-13 16:45:49.000000000 +0200
+++ pure-ftpd-1.0.40/config.h.in	2015-06-16 13:13:38.628079468 +0200
@@ -3,6 +3,9 @@
 /* Define if building universal (internal helper macro) */
 #undef AC_APPLE_UNIVERSAL_BUILD
 
+/* with apparmor */
+#undef APPARMOR
+
 /* display only boring messages */
 #undef BORING_MODE
 
diff -ur pure-ftpd-1.0.40.org/configure.ac pure-ftpd-1.0.40/configure.ac
--- pure-ftpd-1.0.40.org/configure.ac	2015-06-13 13:59:00.000000000 +0200
+++ pure-ftpd-1.0.40/configure.ac	2015-06-16 13:13:38.628079468 +0200
@@ -792,6 +792,13 @@
     AC_DEFINE(QUOTAS,,[with quotas])
   fi ])
 
+AC_ARG_WITH(apparmor,
+[AS_HELP_STRING(--with-apparmorquotas,Support changing Apparmor Hats)],
+[ if test "x$withval" = "xyes" ; then
+    AC_DEFINE(APPARMOR,,[with apparmor])
+    LIBS="$LIBS -lapparmor"
+  fi ])
+
 AC_ARG_WITH(ftpwho,
 [AS_HELP_STRING(--with-ftpwho,Support for pure-ftpwho)],
 [ if test "x$withval" = "xyes" ; then
diff -ur pure-ftpd-1.0.40.org/pureftpd-mysql.conf pure-ftpd-1.0.40/pureftpd-mysql.conf
--- pure-ftpd-1.0.40.org/pureftpd-mysql.conf	2015-05-21 12:18:58.000000000 +0200
+++ pure-ftpd-1.0.40/pureftpd-mysql.conf	2015-06-16 13:13:38.644746557 +0200
@@ -112,6 +112,9 @@
 # MySQLGetBandwidthDL SELECT DLBandwidth FROM users WHERE User='\L'
 
 
+# Optional : Apparmor Hat to use.
+# MYSQLGetApparmorHat SELECT hat FROM users WHERE User='\L'
+
 # Enable ~ expansion. NEVER ENABLE THIS BLINDLY UNLESS :
 # 1) You know what you are doing.
 # 2) Real and virtual users match.
diff -ur pure-ftpd-1.0.40.org/src/ftpd.c pure-ftpd-1.0.40/src/ftpd.c
--- pure-ftpd-1.0.40.org/src/ftpd.c	2015-06-13 12:26:37.000000000 +0200
+++ pure-ftpd-1.0.40/src/ftpd.c	2015-06-16 13:13:38.644746557 +0200
@@ -18,6 +18,9 @@
 #ifdef QUOTAS
 # include "quotas.h"
 #endif
+#ifdef APPARMOR
+# include <sys/apparmor.h>
+#endif
 #ifdef WITH_DIRALIASES
 # include "diraliases.h"
 #endif
@@ -1544,6 +1547,9 @@
         result.ratio_download = ratio_download;
         result.ratio_ul_changed = result.ratio_dl_changed = 0;
 #endif
+#ifdef APPARMOR
+        result.apparmor_hat = NULL;
+#endif
 #ifdef PER_USER_LIMITS
         result.per_user_max = per_user_max;
 #endif
@@ -1982,6 +1988,16 @@
 # endif
     enablesignals();
 #endif
+
+#ifdef APPARMOR
+    if (authresult.apparmor_hat != NULL) {
+        if (change_hat(authresult.apparmor_hat, zrand()) < 0)
+            die(421, LOG_ERR, MSG_CHROOT_FAILED);
+        logfile(LOG_INFO, MSG_APPARMOR_HAT, account, authresult.apparmor_hat);
+        free(authresult.apparmor_hat);
+    }
+#endif
+
     logfile(LOG_INFO, MSG_IS_NOW_LOGGED_IN, account);
 #ifdef FTPWHO
     if (shm_data_cur != NULL) {
diff -ur pure-ftpd-1.0.40.org/src/ftpd.h pure-ftpd-1.0.40/src/ftpd.h
--- pure-ftpd-1.0.40.org/src/ftpd.h	2015-05-21 10:08:42.000000000 +0200
+++ pure-ftpd-1.0.40/src/ftpd.h	2015-06-16 13:13:38.644746557 +0200
@@ -294,6 +294,9 @@
 #ifdef PER_USER_LIMITS
     unsigned int per_user_max;
 #endif
+#ifdef APPARMOR
+    const char *apparmor_hat;
+#endif
 } AuthResult;
 
 typedef struct PureFileInfo_ {
diff -ur pure-ftpd-1.0.40.org/src/log_extauth.c pure-ftpd-1.0.40/src/log_extauth.c
--- pure-ftpd-1.0.40.org/src/log_extauth.c	2015-02-17 19:12:45.000000000 +0100
+++ pure-ftpd-1.0.40/src/log_extauth.c	2015-06-16 13:15:07.670333578 +0200
@@ -215,6 +215,9 @@
     result->uid = (uid_t) 0;
     result->gid = (gid_t) 0;
     result->dir = NULL;
+#ifdef APPARMOR_HAT
+    result->apparmor_hat = NULL;
+#endif
     result->slow_tilde_expansion = 1;
     auth_finalized = 0;
     if ((readnb = safe_read(kindy, line, sizeof line - 1U)) <= (ssize_t) 0) {
diff -ur pure-ftpd-1.0.40.org/src/log_ldap.c pure-ftpd-1.0.40/src/log_ldap.c
--- pure-ftpd-1.0.40.org/src/log_ldap.c	2015-06-11 00:26:19.000000000 +0200
+++ pure-ftpd-1.0.40/src/log_ldap.c	2015-06-16 13:13:38.644746557 +0200
@@ -627,6 +627,9 @@
     if ((result->dir = strdup(pw->pw_dir)) == NULL) {
         return;
     }
+#ifdef APPARMOR
+    result->apparmor_hat = NULL;
+#endif
     result->slow_tilde_expansion = 1;
     result->auth_ok = 1;            /* User found, authentication ok */
 }
diff -ur pure-ftpd-1.0.40.org/src/log_mysql.c pure-ftpd-1.0.40/src/log_mysql.c
--- pure-ftpd-1.0.40.org/src/log_mysql.c	2015-05-21 12:52:57.000000000 +0200
+++ pure-ftpd-1.0.40/src/log_mysql.c	2015-06-16 13:16:21.692207444 +0200
@@ -322,6 +322,9 @@
     const char *bandwidth_ul = NULL;   /* stored bandwidth UL */
     const char *bandwidth_dl = NULL;   /* stored bandwidth DL */
 #endif
+#ifdef APPARMOR
+    const char *apparmor_hat = NULL;    /* Apparmor hat name */
+#endif
     char *escaped_account = NULL;
     char *escaped_ip = NULL;
     char *escaped_port = NULL;
@@ -605,6 +608,15 @@
         }
     }
 #endif
+#ifdef APPARMOR
+    if ((apparmor_hat = pw_mysql_getquery(id_sql_server, sqlreq_getapparmor_hat,
+                                          escaped_account, escaped_ip,
+                                          escaped_port, escaped_peer_ip,
+                                          escaped_decimal_ip)) != NULL) {
+        result->apparmor_hat = apparmor_hat;
+        apparmor_hat = NULL;
+    }
+#endif
     result->slow_tilde_expansion = !tildexp;
     result->auth_ok = -result->auth_ok;
     bye:
@@ -634,6 +646,9 @@
     free((void *) bandwidth_ul);
     free((void *) bandwidth_dl);
 #endif
+#ifdef APPARMOR
+    free((void *) apparmor_hat);
+#endif
     free((void *) escaped_account);
     free((void *) escaped_ip);
     free((void *) escaped_port);
@@ -702,6 +717,9 @@
     ZFREE(sqlreq_getbandwidth_ul);
     ZFREE(sqlreq_getbandwidth_dl);
 #endif
+#ifdef APPARMOR
+    ZFREE(sqlreq_getapparmor_hat);
+#endif
 }
 #else
 extern signed char v6ready;
diff -ur pure-ftpd-1.0.40.org/src/log_mysql_p.h pure-ftpd-1.0.40/src/log_mysql_p.h
--- pure-ftpd-1.0.40.org/src/log_mysql_p.h	2015-02-17 19:12:45.000000000 +0100
+++ pure-ftpd-1.0.40/src/log_mysql_p.h	2015-06-16 13:13:38.648079974 +0200
@@ -38,6 +38,9 @@
 static char *sqlreq_getbandwidth_ul;
 static char *sqlreq_getbandwidth_dl;
 #endif
+#ifdef APPARMOR
+static char *sqlreq_getapparmor_hat;
+#endif
 static signed char server_down;
 
 static ConfigKeywords mysql_config_keywords[] = {
@@ -68,6 +71,9 @@
     { "MYSQLGetBandwidthUL", &sqlreq_getbandwidth_ul },
     { "MYSQLGetBandwidthDL", &sqlreq_getbandwidth_dl },
 #endif
+#ifdef APPARMOR
+    { "MYSQLGetApparmorHat", &sqlreq_getapparmor_hat },
+#endif
     { NULL, NULL }
 };
 
diff -ur pure-ftpd-1.0.40.org/src/log_pam.c pure-ftpd-1.0.40/src/log_pam.c
--- pure-ftpd-1.0.40.org/src/log_pam.c	2015-02-17 19:12:45.000000000 +0100
+++ pure-ftpd-1.0.40/src/log_pam.c	2015-06-16 13:13:38.654746809 +0200
@@ -202,6 +202,9 @@
     (void) pam_close_session(pamh, PAM_SILENT);   /* It doesn't matter if it fails */
 #endif
     result->dir = dir;
+#ifdef APPARMOR
+    result->apparmor_hat = NULL;
+#endif
     dir = NULL;
     result->uid = pw.pw_uid;
     result->gid = pw.pw_gid;
diff -ur pure-ftpd-1.0.40.org/src/log_pgsql.c pure-ftpd-1.0.40/src/log_pgsql.c
--- pure-ftpd-1.0.40.org/src/log_pgsql.c	2015-05-22 16:29:27.000000000 +0200
+++ pure-ftpd-1.0.40/src/log_pgsql.c	2015-06-16 13:18:14.645066852 +0200
@@ -402,6 +402,9 @@
     const char *bandwidth_ul = NULL;   /* stored bandwidth UL */
     const char *bandwidth_dl = NULL;   /* stored bandwidth DL */
 #endif
+#ifdef APPARMOR
+    const char *apparmor_hat = NULL;   /* Apparmor hat name */
+#endif
     char *escaped_account = NULL;
     char *escaped_ip = NULL;
     char *escaped_port = NULL;
@@ -651,6 +654,15 @@
         }
     }
 #endif
+#ifdef APPARMOR
+    if ((apparmor_hat = pw_pgsql_getquery(id_sql_server, sqlreq_getapparmor_hat,
+                escaped_account, escaped_ip,
+                escaped_port, escaped_peer_ip,
+                escaped_decimal_ip)) != NULL) {
+        result->apparmor_hat = apparmor_hat;
+        apparmor_hat = NULL;
+    }
+#endif
     result->slow_tilde_expansion = 1;
     result->auth_ok = -result->auth_ok;
     bye:
@@ -681,6 +693,9 @@
     free((void *) bandwidth_ul);
     free((void *) bandwidth_dl);
 #endif
+#ifdef APPARMOR
+    free((void *) apparmor_hat);
+#endif
     free((void *) escaped_account);
     free((void *) escaped_ip);
     free((void *) escaped_port);
@@ -735,6 +750,9 @@
     ZFREE(sqlreq_getbandwidth_ul);
     ZFREE(sqlreq_getbandwidth_dl);
 #endif
+#ifdef APPARMOR
+    ZFREE(sqlreq_getapparmor_hat);
+#endif
 }
 #else
 extern signed char v6ready;
diff -ur pure-ftpd-1.0.40.org/src/log_pgsql_p.h pure-ftpd-1.0.40/src/log_pgsql_p.h
--- pure-ftpd-1.0.40.org/src/log_pgsql_p.h	2015-02-17 19:12:45.000000000 +0100
+++ pure-ftpd-1.0.40/src/log_pgsql_p.h	2015-06-16 13:13:38.658080227 +0200
@@ -28,6 +28,9 @@
 static char *sqlreq_getbandwidth_ul;
 static char *sqlreq_getbandwidth_dl;
 #endif
+#ifdef APPARMOR
+static char *sqlreq_getapparmor_hat;
+#endif
 static signed char server_down;
 
 static ConfigKeywords pgsql_config_keywords[] = {
@@ -55,6 +58,9 @@
     { "PGSQLGetBandwidthUL", &sqlreq_getbandwidth_ul },
     { "PGSQLGetBandwidthDL", &sqlreq_getbandwidth_dl },
 #endif
+#ifdef APPARMOR
+    { "PGSQLGetApparmorHat", &sqlreq_getapparmor_hat },
+#endif
     { NULL, NULL }
 };
 
diff -ur pure-ftpd-1.0.40.org/src/log_puredb.c pure-ftpd-1.0.40/src/log_puredb.c
--- pure-ftpd-1.0.40.org/src/log_puredb.c	2015-05-21 12:51:56.000000000 +0200
+++ pure-ftpd-1.0.40/src/log_puredb.c	2015-06-16 13:13:38.658080227 +0200
@@ -333,6 +333,9 @@
         result->user_quota_size = strtoull(line, NULL, 10);
     }
 #endif
+#ifdef APPARMOR
+    result->apparmor_hat = NULL;
+#endif
     if ((line = my_strtok2(NULL, *PW_LINE_SEP)) == NULL) {   /* allowed local ip */
         return 0;
     }
diff -ur pure-ftpd-1.0.40.org/src/log_unix.c pure-ftpd-1.0.40/src/log_unix.c
--- pure-ftpd-1.0.40.org/src/log_unix.c	2015-05-21 12:51:38.000000000 +0200
+++ pure-ftpd-1.0.40/src/log_unix.c	2015-06-16 13:13:38.658080227 +0200
@@ -81,6 +81,9 @@
     result->uid = pw.pw_uid;
     result->gid = pw.pw_gid;
     result->dir = dir;
+#ifdef APPARMOR
+    result->apparmor_hat = NULL;
+#endif
     result->slow_tilde_expansion = 0;
     result->auth_ok = -result->auth_ok;
     return;
diff -ur pure-ftpd-1.0.40.org/src/Makefile.am pure-ftpd-1.0.40/src/Makefile.am
--- pure-ftpd-1.0.40.org/src/Makefile.am	2015-05-21 16:25:39.000000000 +0200
+++ pure-ftpd-1.0.40/src/Makefile.am	2015-06-16 13:13:38.658080227 +0200
@@ -136,6 +136,7 @@
 pure_ftpd_LDADD = \
 	libpureftpd.a \
 	../puredb/src/libpuredb_read.a \
+	-lapparmor \
 	@LDAP_SSL_LIBS@ @GETLOADAVG_LIBS@ @BONJOUR_LDADD@
 
 pure_ftpd_SOURCES = \
diff -ur pure-ftpd-1.0.40.org/src/messages_en.h pure-ftpd-1.0.40/src/messages_en.h
--- pure-ftpd-1.0.40.org/src/messages_en.h	2015-05-20 16:23:20.000000000 +0200
+++ pure-ftpd-1.0.40/src/messages_en.h	2015-06-16 13:13:38.658080227 +0200
@@ -57,6 +57,7 @@
 #define MSG_CURRENT_DIR_IS "OK. Current directory is %s"
 #define MSG_CURRENT_RESTRICTED_DIR_IS "OK. Current restricted directory is %s"
 #define MSG_IS_NOW_LOGGED_IN "%s is now logged in"
+#define MSG_APPARMOR_HAT "User %s apparmor hat is %s"
 #define MSG_CANT_CHANGE_DIR "Can't change directory to %s"
 #define MSG_PATH_TOO_LONG "Path too long"
 #define MSG_CANT_PASV "You cannot use PASV on IPv6 connections. Use EPSV instead."