--- a/utils/aa-unconfined
+++ b/utils/aa-unconfined
@@ -118,7 +118,7 @@ def read_proc_current(filename):
 pids = set()
 if paranoid:
     pids = get_all_pids()
-elif args.with_ss or (not args.with_netstat and (os.path.exists('/bin/ss') or os.path.exists('/usr/bin/ss'))):
+elif args.with_ss or (not args.with_netstat and (os.path.exists('/usr/sbin/ss') or os.path.exists('/bin/ss') or os.path.exists('/usr/bin/ss') or os.path.exists('/sbin/ss'))):
     pids = get_pids_ss()
 else:
     pids = get_pids_netstat()