I have similar issue on Kubuntu 17.10. Consider this denied message in audit log:
$ sudo fgrep -eDENIED /var/log/audit/audit.log -A2 type=AVC msg=audit(1510405906.890:426): apparmor="DENIED" operation="connect" profile="/usr/bin/dragon" pid=7338 comm="QDBusConnection" family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send connect" addr=none peer_addr="@/tmp/dbus-y2LWR0Es6j" peer="unconfined" type=SYSCALL msg=audit(1510405906.890:426): arch=c000003e syscall=42 success=no exit=-13 a0=8 a1=7f821b3c84b0 a2=17 a3=0 items=0 ppid=1382 pid=7338 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=3 comm="QDBusConnection" exe="/usr/bin/dragon" key=(null) type=PROCTITLE msg=audit(1510405906.890:426): proctitle=2F7573722F62696E2F647261676F6E002F686F6D652F76696E6361732F41747369756E74696D61692F6269676275636B62756E6E792E7765626D
Meanwhile aa-logprof prints nothing in that regard:
$ sudo aa-logprof Reading log entries from /var/log/audit/audit.log. Updating AppArmor profiles in /etc/apparmor.d.
I have similar issue on Kubuntu 17.10. Consider this denied message in audit log:
$ sudo fgrep -eDENIED /var/log/ audit/audit. log -A2 1510405906. 890:426) : apparmor="DENIED" operation="connect" profile= "/usr/bin/ dragon" pid=7338 comm="QDBusConn ection" family="unix" sock_type="stream" protocol=0 requested_ mask="send receive connect" denied_mask="send connect" addr=none peer_addr= "@/tmp/ dbus-y2LWR0Es6j " peer="unconfined" 1510405906. 890:426) : arch=c000003e syscall=42 success=no exit=-13 a0=8 a1=7f821b3c84b0 a2=17 a3=0 items=0 ppid=1382 pid=7338 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=3 comm="QDBusConn ection" exe="/usr/ bin/dragon" key=(null) 1510405906. 890:426) : proctitle= 2F7573722F62696 E2F647261676F6E 002F686F6D652F7 6696E6361732F41 747369756E74696 D61692F62696762 75636B62756E6E7 92E7765626D
type=AVC msg=audit(
type=SYSCALL msg=audit(
type=PROCTITLE msg=audit(
Meanwhile aa-logprof prints nothing in that regard:
$ sudo aa-logprof audit/audit. log.
Reading log entries from /var/log/
Updating AppArmor profiles in /etc/apparmor.d.