@Tyler
apparmor logs seems good; like that example:
audit: type=1400 audit(1470130477.689:35): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/lib/lightdm/lightdm-guest-session" pid=20307 comm="apparmor_parser"
@Tyler
apparmor logs seems good; like that example:
audit: type=1400 audit(147013047 7.689:35) : apparmor="STATUS" operation= "profile_ replace" profile= "unconfined" name="/ usr/lib/ lightdm/ lightdm- guest-session" pid=20307 comm="apparmor_ parser"