aa-cleanprof drops audit modifier incorrectly

With a slightly different test profile, I get:

 /usr/bin/true {
- /bin/false ix,
- audit /bin/false ix,
- audit /bin/true ix,
- /bin/true ix,
+ audit /bin/false ix,
+ /bin/true ix,
 }

At the beginning of cleanprofile.py delete_path_duplicates(), we have:

profile[allow]['path'] {
    '/bin/true': defaultdict(<function hasher at 0x7f32d7650ae8>, {'mode': {'x', 'i', '::i', '::x'}, 'audit': set()}),
    '/bin/false': defaultdict(<function hasher at 0x7f32d7650ae8>, {'mode': {'x', 'i', '::i', '::x'}, 'audit': {'x', 'i', '::x', '::i'}})
}

profile_other[allow]['path'] is exactly the same.

This seems to be a "last one wins" :-( and is probably a bug in parsing the profiles, not in aa-cleanprof / cleanprof.py itsself. This also means the audit keyword could (untested!) get lost in a normal aa-logprof run.

This is fixed with the FileRule patch series I posted to the mailinglist two days ago. FileRule uses a completely different method to store file rules, and overwriting parameters of an existing rule can't happen unless doing someting totally and obviously crazy in the code.

I also confirmed by manual testing that aa-cleanprof will keep the audit rule.

Nevertheless, a second pair of eyes never hurts. Can you please test and report back?

I commited the FileRule series yesterday, which means this is fixed in bzr trunk.