let logparser.py parse_event() change disconnected path events to 'ERROR'

This means that aa-logprof will ignore the event instead of crashing with
    AppArmorException: 'Unexpected rank input: var/run/nscd/passwd'

Note that I made the check as specific as possible to be sure it doesn't
hide other events.

References: https://bugzilla.opensuse.org/show_bug.cgi?id=918787



Acked-by: Steve Beattie <steve@nxnw.org> for 2.9



(This is a backport of trunk r2877, but without the test-capability.py
adjustment because that file doesn't exist in 2.9)

utils/apparmor/logparser.py

@@ -111,6 +111,7 @@ class ReadLog:
         ev['pid'] = event.pid
         ev['task'] = event.task
         ev['info'] = event.info
+        ev['error_code'] = event.error_code
         dmask = event.denied_mask
         rmask = event.requested_mask
         ev['magic_token'] = event.magic_token
@@ -162,6 +163,11 @@ class ReadLog:
             except KeyError:
                 ev['aamode'] = None
 
+        # "translate" disconnected paths to errors, which means the event will be ignored.
+        # XXX Ideally we should propose to add the attach_disconnected flag to the profile
+        if ev['error_code'] == 13 and ev['info'] == 'Failed name lookup - disconnected path':
+            ev['aamode'] = 'ERROR'
+
         if ev['aamode']:
             #debug_logger.debug(ev)
             return ev