Sorry, when reporting a patch you shouldn't forget to attach the patch. :-/
--- audit.ok 2013-05-28 17:17:20.000000000 +0200
+++ audit 2013-05-28 17:32:29.000000000 +0200
@@ -165,6 +165,13 @@
# type=1400 audit(1314853822.672:33649): apparmor="DENIED" operation="mknod" parent=27250 profile="/usr/lib/apache2/mpm-prefork/apache2//example.com" name="/usr/share/wordpress/1114140474e5f13bea68a4.tmp" pid=27289 comm="apache2" requested_mask="c" denied_mask="c" fsuid=33 ouid=33
# type=1400 audit(1315353795.331:33657): apparmor="DENIED" operation="exec" parent=14952 profile="/usr/lib/apache2/mpm-prefork/apache2//example.com" name="/usr/lib/sm.bin/sendmail" pid=14953 comm="sh" requested_mask="x" denied_mask="x" fsuid=33 ouid=0
$denials{$1.' '.$3.' ('.$2.' via '.$4 . ')'}++;
+ } elsif ( $ThisLine =~ /apparmor="ALLOWED" operation="([^"]+)" parent=\d+ profile="([^"]+)" name="([^"]+)" pid=\d+ comm="([^"]+)"/ ) {
+ # type=1400 audit(1369519203.141:259049): apparmor="ALLOWED" operation="exec" parent=3733 profile="/usr/sbin/dovecot//null-1c//null-1d" name="/usr/lib/dovecot/pop3-login" pid=24634 comm="dovecot" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 target="/usr/sbin/dovecot//null-1c//null-1d//null-d12"
+ # type=1400 audit(1369519203.141:259050): apparmor="ALLOWED" operation="open" parent=3733 profile="/usr/sbin/dovecot//null-1c//null-1d//null-d12" name="/usr/lib/dovecot/libdovecot-login.so.0.0.0" pid=24634 comm="pop3-login" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
+ $grants{$1.' from '.$4}++;
+ } elsif ( $ThisLine =~ /apparmor="ALLOWED" operation="([^"]+)" parent=\d+ profile="([^"]+)" pid=\d+ comm="([^"]+)"/ ) {
+ # type=1400 audit(1369627891.522:447576): apparmor="ALLOWED" operation="capable" parent=1 profile="/usr/sbin/dovecot//null-1c//null-1d" pid=3733 comm="dovecot" capability=5 capname="kill"
+ $grants{$1.' from '.$3}++;
} else {
$othercount++;
$ThisLine =~ s/^\s*//;
