From 1b58efa1b29d43aeb2b4dcdf2d358bd6c465d2e4 Mon Sep 17 00:00:00 2001
From: Kirill Trofimov <g3rhard@users.noreply.github.com>
Date: Wed, 9 Dec 2020 15:14:50 +0100
Subject: [PATCH 1/2] add parental rule id for rule 52000

---
 etc/rules/apparmor_rules.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/etc/rules/apparmor_rules.xml b/etc/rules/apparmor_rules.xml
index f5f38f50a..601b8add8 100644
--- a/etc/rules/apparmor_rules.xml
+++ b/etc/rules/apparmor_rules.xml
@@ -14,6 +14,7 @@
 <group name="local,syslog,apparmor">
 
   <rule id="52000" level="3">
+    <if_sid>1002</if_sid>
     <decoded_as>iptables</decoded_as>
     <pcre2> apparmor=</pcre2>
     <description>Apparmor grouping</description>

From c3ee26091de28a206050020ac7c2820a8e3cceb5 Mon Sep 17 00:00:00 2001
From: Kirill Trofimov <g3rhard@users.noreply.github.com>
Date: Wed, 9 Dec 2020 15:50:09 +0100
Subject: [PATCH 2/2] found better sid for rule 52000

---
 etc/rules/apparmor_rules.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/rules/apparmor_rules.xml b/etc/rules/apparmor_rules.xml
index 601b8add8..3e4722195 100644
--- a/etc/rules/apparmor_rules.xml
+++ b/etc/rules/apparmor_rules.xml
@@ -14,7 +14,7 @@
 <group name="local,syslog,apparmor">
 
   <rule id="52000" level="3">
-    <if_sid>1002</if_sid>
+    <if_sid>5100</if_sid>
     <decoded_as>iptables</decoded_as>
     <pcre2> apparmor=</pcre2>
     <description>Apparmor grouping</description>