Can you do
sudo aa-complain cupsd
and see whether the file now gets overwritten? Can you also look for messages containing "audit" in the output of "dmesg" and in the file /var/log/messages?
Can you do
sudo aa-complain cupsd
and see whether the file now gets overwritten? Can you also look for messages containing "audit" in the output of "dmesg" and in the file /var/log/messages?