aa-logprof crash on #include <directory>

aa-logprof crashes on profiles that contain an #include <directory> _if_ there are events for this profile.

2.9 crash:

# aa-logprof -f /tmp/syslog
Lese Logeinträge von /tmp/syslog.
Aktualisiere AppArmor-Profile in /etc/apparmor.d.
Traceback (most recent call last):
  File "aa-logprof", line 54, in <module>
    apparmor.do_logprof_pass(logmark)
  File "/home/cb/apparmor/2.9-branch/utils/apparmor/aa.py", line 2297, in do_logprof_pass
    collapse_log()
  File "/home/cb/apparmor/2.9-branch/utils/apparmor/aa.py", line 2533, in collapse_log
    if not profile_known_network(aa[profile][hat], family, sock_type):
  File "/home/cb/apparmor/2.9-branch/utils/apparmor/aa.py", line 4394, in profile_known_network
    if netrules_access_check(include[incname][incname]['deny']['netdomain'], family, sock_type):
KeyError: 'apache2.d'

trunk crash:

# aa-logprof -f /tmp/syslog
Lese Logeinträge von /tmp/syslog.
Aktualisiere AppArmor-Profile in /etc/apparmor.d.
Traceback (most recent call last):
  File "aa-logprof", line 50, in <module>
    apparmor.do_logprof_pass(logmark)
  File "/home/cb/apparmor/HEAD-clean/utils/apparmor/aa.py", line 2189, in do_logprof_pass
    collapse_log()
  File "/home/cb/apparmor/HEAD-clean/utils/apparmor/aa.py", line 2426, in collapse_log
    if not is_known_rule(aa[profile][hat], 'network', NetworkRule(family, sock_type)):
  File "/home/cb/apparmor/HEAD-clean/utils/apparmor/aa.py", line 4099, in is_known_rule
    if include[incname][incname].get(rule_type, False):
KeyError: 'apache2.d'

Reproducer: (slightly faked log event, apache didn't request network raw)

aa-logprof -f <(echo 'Jul 2 06:39:54 piorun kernel: [5579093.070893] audit: type=1400 audit(1435811994.122:696484): apparmor="ALLOWED" operation="accept" profile="/usr/sbin/apache2" pid=18852 comm="apache2" lport=443 family="inet6" sock_type="raw" protocol=6')

Note: If you test with old logs, it doesn't happen always because is_known_rule() / profile_known_*() exits as soon as it finds a match, and the order of include files is random - which means it doesn't always loop until it hits the directory include.

I'm afraid that this affects the profile_known_*() functions for all rule types.