diff --git a/profiles/apparmor.d/local/README b/profiles/apparmor.d/local/README
index 336ff1603..a3cf2e49a 100644
--- a/profiles/apparmor.d/local/README
+++ b/profiles/apparmor.d/local/README
@@ -17,7 +17,7 @@
 # then an administrator can adjust /etc/apparmor.d/local/usr.sbin.smbd to
 # contain any additional paths to be allowed, such as:
 #
-#   /var/exports/** lrw,
+#   /var/exports/** lrwk,
 #
 # Keep in mind that 'deny' rules are evaluated after allow rules, so you won't
 # be able to allow access to files that are explicitly denied by the shipped
diff --git a/profiles/apparmor.d/usr.sbin.smbd b/profiles/apparmor.d/usr.sbin.smbd
index 041ac3eb9..886fbaa37 100644
--- a/profiles/apparmor.d/usr.sbin.smbd
+++ b/profiles/apparmor.d/usr.sbin.smbd
@@ -32,7 +32,7 @@
   /var/log/samba/cores/smbd/** rw,
   /var/spool/samba/** rw,
 
-  @{HOMEDIRS}/** lrw,
+  @{HOMEDIRS}/** lrwk,
 
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.sbin.smbd>