[Apparmor-dev] [RFR] patches for profile tools to work with the latest kernel

[jesse michael]

On Fri, Jul 13, 2007 at 01:09:50PM -0600, Dominic Reynolds wrote:
>  audit_format.diff 
>    * Read in the new audit message format used by the module.
>      There are still some outstanding issues around special casing behaviour
>      that have not been ported to work in the new format. This is ongoing and
>      does not prevent basic profiling.

I'm running into events with--

  operation="setattr" requested_mask="w" denied_mask="w" attribute="mode,ctime," name="/home/jesse/.gnome2_private/"

...that logprof isn't prompting about.  Those should just generate 
"/home/jesse/.gnome2_private/ w" rules currently.  Thanks.