diff --git a/apparmor.d/profiles-g-l/kdestroy b/apparmor.d/profiles-g-l/kdestroy
index 1e34b0193..0a4ed9ab5 100644
--- a/apparmor.d/profiles-g-l/kdestroy
+++ b/apparmor.d/profiles-g-l/kdestroy
@@ -10,11 +10,11 @@ include <tunables/global>
 profile kdestroy @{exec_path} {
   include <abstractions/base>
 
-  @{exec_path} mr,
-
   #Allow root to destroy other users' creds cache
   capability dac_override,
 
+  @{exec_path} mr,
+
   #Config Files
   /etc/krb5.conf r,
   /etc/krb5.conf.d/{,**} r,