Comment # 4 on bug 1225811 from Noel Power

(In reply to Noel Power from comment #3)
> Created attachment 875353 [details]
> patchj to squash apparmor errors

the only log entry I got was similar to the one already mentioned in comment #0

grep witness apparmor-witness/audit.log 
type=AVC msg=audit(1717665586.168:324): apparmor="DENIED" operation="exec"
class="file" profile="samba-dcerpcd" name="/usr/lib64/samba/rpcd_witness"
pid=8516 comm="samba-dcerpcd" requested_mask="x" denied_mask="x" fsuid=0 ouid=0


and I invoked all of the rpc methods the new rpcd_witness service provides
(with no extra DENIES observed)

I *think* the change attached is all that is required (there didn't seem to be
any need to add 'witness' to any of the existing entries in the 'common'
samba-rpcd profile) but maybe for completeness we should ? I did have changes
here but on the second run (after a reboot) I didn't seem to need them (but
that might be some cache issue) I will attach the full set of modifications
here also