After typing
sudo aa-complain cupsd
the file is now being silently overwritten rather than silently dropped. Here's the output of "dmseg | grep audit":
dmesg | grep audit [ 10.189164] audit: initializing netlink socket (disabled) [ 10.189182] audit(1196931018.944:1): initialized [ 11.846885] AppArmor: AppArmor initialized<5>audit(1196931020.944:2): type=1505 info="AppArmor initialized" pid=1273 [ 19.976000] audit(1196931037.270:3): type=1503 operation="inode_permission" requested_mask="a" denied_mask="a" name="/dev/tty" pid=5125 profile="/usr/sbin/cupsd" [25950.892000] audit(1196956968.247:4): type=1503 operation="capable" name="dac_override" pid=11714 profile="/usr/lib/cups/backend/cups-pdf" [25950.892000] audit(1196956968.247:5): type=1503 operation="capable" name="dac_read_search" pid=11714 profile="/usr/lib/cups/backend/cups-pdf" [26008.200000] audit(1196957025.751:6): type=1503 operation="capable" name="dac_override" pid=11743 profile="/usr/lib/cups/backend/cups-pdf" [26008.200000] audit(1196957025.751:7): type=1503 operation="capable" name="dac_read_search" pid=11743 profile="/usr/lib/cups/backend/cups-pdf" [26008.264000] audit(1196957025.751:8): type=1503 operation="inode_permission" requested_mask="rw" denied_mask="r" name="/home/mthaddon/PDF/Slashdot__News_for_nerds__stuff_that_matters.pdf" pid=11746 profile="/usr/lib/cups/backend/cups-pdf" [26043.228000] audit(1196957060.753:9): type=1502 operation="capable" name="dac_override" pid=11757 profile="/usr/lib/cups/backend/cups-pdf"
After typing
sudo aa-complain cupsd
the file is now being silently overwritten rather than silently dropped. Here's the output of "dmseg | grep audit":
dmesg | grep audit 8.944:1) : initialized 5>audit( 1196931020. 944:2): type=1505 info="AppArmor initialized" pid=1273 7.270:3) : type=1503 operation= "inode_ permission" requested_mask="a" denied_mask="a" name="/dev/tty" pid=5125 profile= "/usr/sbin/ cupsd" 8.247:4) : type=1503 operation="capable" name="dac_override" pid=11714 profile= "/usr/lib/ cups/backend/ cups-pdf" 8.247:5) : type=1503 operation="capable" name="dac_ read_search" pid=11714 profile= "/usr/lib/ cups/backend/ cups-pdf" 5.751:6) : type=1503 operation="capable" name="dac_override" pid=11743 profile= "/usr/lib/ cups/backend/ cups-pdf" 5.751:7) : type=1503 operation="capable" name="dac_ read_search" pid=11743 profile= "/usr/lib/ cups/backend/ cups-pdf" 5.751:8) : type=1503 operation= "inode_ permission" requested_mask="rw" denied_mask="r" name="/ home/mthaddon/ PDF/Slashdot_ _News_for_ nerds__ stuff_that_ matters. pdf" pid=11746 profile= "/usr/lib/ cups/backend/ cups-pdf" 0.753:9) : type=1502 operation="capable" name="dac_override" pid=11757 profile= "/usr/lib/ cups/backend/ cups-pdf"
[ 10.189164] audit: initializing netlink socket (disabled)
[ 10.189182] audit(119693101
[ 11.846885] AppArmor: AppArmor initialized<
[ 19.976000] audit(119693103
[25950.892000] audit(119695696
[25950.892000] audit(119695696
[26008.200000] audit(119695702
[26008.200000] audit(119695702
[26008.264000] audit(119695702
[26043.228000] audit(119695706