diff --git a/utils/apparmor/logparser.py b/utils/apparmor/logparser.py index 0e74c3f5..5738bb10 100644 --- a/utils/apparmor/logparser.py +++ b/utils/apparmor/logparser.py @@ -118,7 +118,7 @@ class ReadLog: ev['protocol'] = event.net_protocol ev['sock_type'] = event.net_sock_type - if event.ouid != 18446744073709551615: # 2^64 - 1 + if event.ouid != 18446744073709551615 and event.ouid != 4294967295: # 2^64 - 1 and 2^32 - 1 ev['fsuid'] = event.fsuid ev['ouid'] = event.ouid