Apparmor has hats like null-12b08

I am running a Ubuntu 12.04.2 server with Apache using mod_apparmor. When I run aa-status, I see thousands and thousands (seriously, over 100,000) of profiles with names like

/usr/lib/apache2/mpm-prefork/apache2//DEFAULT_URI//null-12b08

Some of them even stack:

/usr/lib/apache2/mpm-prefork/apache2//scoop//null-2dd76//null-2dd77

What are these? Are they actually hats? If so, why are there so many of them, and is that a potential problem?


Solution 1:

These hats are the result of a profile in complain mode. They will accumulate, but you can clear them with a restart. Once the profile is in enforce mode, they will stop being created.