Comment # 1 on bug 1210217 from Christian Boltz

I wonder about the   class="file"   part of the log message - that's quite new
on the kernel side, and probably not supported by the libapparmor version in
15.4.

Do you use the kernel that comes with 15.4 (including update repos), or did you
install a newer kernel from an additional repo?

(As a sidenote, the rule you added looks correct.)