$ echo "/t { pivot_root oldroot=/ /a, }" | apparmor_parser -qS | md5sum 422b222b6608dff7aca3420062aad3db - $ echo "/t { audit pivot_root oldroot=/ /a, }" | apparmor_parser -qS | md5sum 422b222b6608dff7aca3420062aad3db - $ echo "/t { audit deny pivot_root oldroot=/ /a, }" | apparmor_parser -qS | md5sum 9e598c327781b16acdab2d3e939279ec -
Note that the audit modifier doesn't change the binary policy file but the audit deny modifier does.
$ echo "/t { pivot_root oldroot=/ /a, }" | apparmor_parser -qS | md5sum 7aca3420062aad3 db - 7aca3420062aad3 db - acdab2d3e939279 ec -
422b222b6608dff
$ echo "/t { audit pivot_root oldroot=/ /a, }" | apparmor_parser -qS | md5sum
422b222b6608dff
$ echo "/t { audit deny pivot_root oldroot=/ /a, }" | apparmor_parser -qS | md5sum
9e598c327781b16
Note that the audit modifier doesn't change the binary policy file but the audit deny modifier does.