Today I learned that inotify can be used freely to enumerate open files despite apparmor

[odomingao]

While DAC rules prevent inotify from working on files not readable by the user, apparmor alone doesn't. Therefore, it's possible for a profile with minimal permissions to enumerate files on the system when they are open, so filenames and time of access aren't private.

I'm sure that this is known by the more experienced people here, but I figured that it was worth sharing as some may not know this.