aa-enforce doesn't remove complain flag in hats

[Christian Boltz]

From https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1322764

$ aa-enforce /etc/apparmor.d/usr.sbin.apache2
$ ls /etc/apparmor.d/disable | grep apache2 | wc -l
0
$ grep complain /etc/apparmor.d/usr.sbin.apache2
  ^DEFAULT_URI flags=(complain) {
  ^HANDLING_UNTRUSTED_INPUT flags=(complain) {

-> bug: complain not removed on hats when aa-enforce runs

aa-complain most probably shares this bug the other way round.

Bonus points for adding a commandline option to only switch the flag of the main profile or only a specific hat ;-)

[Christian Boltz (cboltz)]

This also happens with the python utils.

[Christian Boltz (cboltz)]

Fix commited to bzr trunk r3050 and 2.9 branch r2918.

[Steve Beattie (sbeattie)]

AppArmor 2.10 has been released: https://launchpad.net/apparmor/2.10/2.10