That's caused by the fact that the rules are exact duplicates, and how we store them in the aa hasher
For example the two #include lines map to
aa['/usr/sbin/ntpd']['/usr/sbin/ntpd']['include']['abstractions/xad'] = True
aa['/usr/sbin/ntpd']['/usr/sbin/ntpd']['include']['abstractions/xad'] = True
so the de-duplication accidently ;-) already happens in parse_profile_data and isn't even recognized as de-duplication.
The same happens for the two identical file rules, except that parsing and storing them is a bit more interesting[tm].
That's caused by the fact that the rules are exact duplicates, and how we store them in the aa hasher
For example the two #include lines map to '/usr/sbin/ ntpd'][ '/usr/sbin/ ntpd'][ 'include' ]['abstractions /xad'] = True '/usr/sbin/ ntpd'][ '/usr/sbin/ ntpd'][ 'include' ]['abstractions /xad'] = True
aa[
aa[
so the de-duplication accidently ;-) already happens in parse_profile_data and isn't even recognized as de-duplication.
The same happens for the two identical file rules, except that parsing and storing them is a bit more interesting[tm].