[Apparmor-general] Where the apparmor modules hooked in the kernel

[S Kalyanasundaram]

Hi All,
I have got a basic doubt in apparmor. I was looking at http://en.opensuse.org/AppArmor_Detail It says the system call is not being replaced and it is hooked deep in to the kernel. Still i dont understand like how it really works. Is it something like prepended with system call tables entries, but how? Is it hooked before vfs? Can anybody give me some visible to me on how the access flow from application happens?

Thanks in advance,
   -"kalyan"