i2p и apparmor - постоянный постинг в лог

Jan 19 17:50:48 ubuntu-server kernel: [ 1657.064671] audit: type=1400 audit(1547909448.973:204220): apparmor="ALLOWED" operation="recvmsg" profile="system_i2p//null-/usr/lib/jvm/java-8-oracle/jre/bin/java" pid=1503 comm="java" lport=12621 family="inet6" sock_type="dgram" protocol=17 requested_mask="receive" denied_mask="receive"
Jan 19 17:50:48 ubuntu-server kernel: [ 1657.065256] audit: type=1400 audit(1547909448.973:204221): apparmor="ALLOWED" operation="sendmsg" profile="system_i2p//null-/usr/lib/jvm/java-8-oracle/jre/bin/java" pid=1503 comm="java" lport=12621 family="inet6" sock_type="dgram" protocol=17 requested_mask="send" denied_mask="send"

stetzen@ubuntu-server:/etc/apparmor.d$ cat system_i2p
# Last Modified: Sun Dec 06 12:30:32 2015
# vim:syntax=apparmor et
#include <tunables/global>

profile system_i2p flags=(complain) {
  #include <abstractions/i2p>

  network,

  owner /{,lib/live/mount/overlay/}var/lib/i2p/** rwk,
  owner /{,lib/live/mount/overlay/}var/lib/i2p/i2p-config/eepsite/cgi-bin rix,
  owner /{,lib/live/mount/overlay/}var/log/i2p/* rw,

  owner /{,var/}run/i2p/{i2p,routerjvm}.pid rw,
  owner /{,var/}run/i2p/router.ping rw,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/system_i2p>
}

stetzen@stetzen-ubunru-server:/etc/apparmor.d$ cat abstractions/i2p
# Last Modified: Sun Dec 06 12:30:32 2015
# vim:syntax=apparmor et ts=4 sw=4

  #include <abstractions/base>
  #include <abstractions/fonts>
  #include <abstractions/nameservice>
  #include <abstractions/ssl_certs>

  # Needed by Java
  @{PROC}                                                 r,
  owner @{PROC}/[0-9]*/                                   r,
  owner @{PROC}/[0-9]*/status                             r,
  @{PROC}/[0-9]*/net/ipv6_route                           r,
  @{PROC}/[0-9]*/net/if_inet6                             r,
  /sys/devices/system/cpu/                                r,
  /sys/devices/system/cpu/**                              r,

  /etc/ssl/certs/java/**                                  r,
  /etc/timezone                                           r,
  /usr/share/javazi/**                                    r,

  /etc/java-*-openjdk/**                                  r,
  /usr/lib/jvm/default-java/jre/bin/java                  rix,
  /usr/lib/jvm/java-*-openjdk-*/jre/bin/java              rix,
  /usr/lib/jvm/java-*-openjdk-*/jre/bin/keytool           rix,

  # Oracle Java is needed on the Raspberry Pi and is included in Raspbian's repositories
  /usr/lib/jvm/jdk-*-oracle-*/jre/bin/java                rix,
  /usr/lib/jvm/jdk-*-oracle-*/jre/bin/keytool             rix,

  # */client/classes.jsa is only found (and needed) in 32-bit JVMs.
  /usr/lib/jvm/java-*-openjdk-*/jre/lib/i386/client/classes.jsa m,
  /usr/lib/jvm/java-*-oracle-*/jre/lib/i386/client/classes.jsa m,

  # needed for I2P's graphs
  /usr/share/java/java-atk-wrapper.jar                    r,

  # I2P specific
  /usr/share/i2p/**                                       r,

  # Used by some plugins
  /usr/share/java/eclipse-ecj-*.jar                       r,

  # Tanuki java wrapper
  /etc/i2p/wrapper.config                                 r,
  /usr/sbin/wrapper                                       rix,
  /usr/share/java/wrapper*.jar                            r,

  # Dependent packages
  /usr/share/java/libintl.jar                             r,
  /usr/share/java/glassfish-appserv-jstl.jar              r,
  /usr/share/maven-repo/jstl/jstl/1.2/jstl-1.2.jar        r,
  /usr/share/java/gnu-getopt.jar                          r,
  /usr/share/java/gnu-getopt-*.jar                        r,
  /usr/share/java/jetty9-*.jar                            r,
  /usr/share/java/jsp-api-*.jar                           r,
  /usr/share/java/servlet-api-*.jar                       r,
  /usr/share/java/standard.jar                            r,
  /usr/share/java/standard-*.jar                          r,
  /usr/share/java/tomcat8-*.jar                           r,
  /usr/share/java/taglibs-standard-*.jar                  r,
  /usr/share/flags/countries/16x11/*                      r,

  # GeoIP data
  /usr/share/GeoIP/*                                      r,

  # Other /proc
  @{PROC}/cpuinfo                                         r,
  @{PROC}/net/if_inet6                                    r,

  # 'm' is needed by the I2P-Bote plugin
  /{,lib/live/mount/overlay/}tmp/                         rwm,
  owner /{,lib/live/mount/overlay/}tmp/hsperfdata_i2psvc/ rwk,
  owner /{,lib/live/mount/overlay/}tmp/hsperfdata_i2psvc/** rw,
  owner /{,lib/live/mount/overlay/}tmp/wrapper*           rwk,
  owner /{,lib/live/mount/overlay/}tmp/wrapper*/**        rw,
  # Scrypt used by I2P-Bote
  owner /{,lib/live/mount/overlay/}tmp/scrypt*            rwk,
  owner /{,lib/live/mount/overlay/}tmp/scrypt*/**         rw,

  # temp dir (service)
  owner /{,lib/live/mount/overlay/}tmp/i2p-daemon/        rwm,
  owner /{,lib/live/mount/overlay/}tmp/i2p-daemon/**      rwkm,
  # temp dir (non-service)
  owner /{,lib/live/mount/overlay/}tmp/i2p-*.tmp/         rwm,
  owner /{,lib/live/mount/overlay/}tmp/i2p-*.tmp/**       rwkm,

  # /graphs in the router console
  owner /{,lib/live/mount/overlay/}tmp/imageio[0-9]*.tmp  rwk,

  # Prevent spamming the logs
  deny /dev/tty                                           rw,
  deny /{,lib/live/mount/overlay/}var/tmp/                r,
  deny @{PROC}/[0-9]*/fd/                                 r,
  deny /usr/sbin/                                         r,
  deny /var/cache/fontconfig/                             wk,

  network inet,
  network inet6,


  # Some versions of the Tanuki wrapper package will try to load these jars but
  # they are  not needed by I2P. The deny rule here will prevent the logs from
  # being spammed.
  deny /usr/share/java/hamcrest*.jar                      r,
  deny /usr/share/java/junit*.jar                         r,

  network inet,
  network inet6,