diff --git a/pkg/aa/template.go b/pkg/aa/template.go
index 616969fd..b5600286 100644
--- a/pkg/aa/template.go
+++ b/pkg/aa/template.go
@@ -71,6 +71,7 @@ var (
 	// The order the apparmor file rules should be sorted
 	fileAlphabet = []string{
 		"@{exec_path}",        // 1. entry point
+		"@{sh_path}",          // 2.1 shells
 		"@{bin}",              // 2.1 binaries
 		"@{lib}",              // 2.2 libraries
 		"/opt",                // 2.3 opt binaries & libraries
diff --git a/pkg/logs/logs.go b/pkg/logs/logs.go
index 8aa4bf51..974137c1 100644
--- a/pkg/logs/logs.go
+++ b/pkg/logs/logs.go
@@ -63,7 +63,7 @@ var (
 
 		// Some system glob
 		`:1.[0-9]*`, `:*`, // dbus peer name
-		`@{bin}/(|ba|da)sh`, `@{bin}/{,ba,da}sh`, // collect all shell
+		`@{bin}/(|ba|da)sh`, `@{sh_path}`, // collect all shell
 		`@{lib}/modules/[^/]+\/`, `@{lib}/modules/*/`, // strip kernel version numbers from kernel module accesses
 		`[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][-_][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][-_][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][-_][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][-_][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]`, `@{uuid}`,
 		`[0-9][0-9][0-9][0-9][0-9][0-9]+`, `@{int}`,