aa-logprof doesn't recognize rules for denied permissions (no matching against variables)

[brian]

aa-logprof seems to be ignoring rules already set in the policy as denied. If I set a rule as denied, the next time I run aa-logprof it asks about it again.

[Christian Boltz (cboltz)]

I know we had some of these bugs, but it depends on
- the rule type (file, capability, network, ...)
- the version of the AppArmor tools (I did quite some changes and fixes for each release)
- the rules you already have in your profile (for example, do they contain wildcars or variables?)

Can you please add some details about these things?

If in doubt, please attach your audit.log (or a sniplet from it that reproduces the bug), the affected profile and a "screenshot" of the aa-logprof run.

[brian (knotwurk)]

I'm running xubuntu 17.04, and I think I may have been mistaken about this. It seems fine now, and the problem was a combination of two things: the wrong permission being denied, and the @{HOME} variable not being recognized by aa-logprof (it's fine in apparmor though). That problem with @{HOME} still exists, although idk if you'd really call it a bug or a missing feature.