[apparmor] profile help request: operation="rename_src"

[apparmor at raf.org]

Hi,

After many months of happy operation, named has just
started causing messages like the following:

  apparmor="DENIED"
  operation="open"
  profile="/usr/sbin/named"
  name="/var/log/bind/"
  pid=624
  comm="named"
  requested_mask="r"
  denied_mask="r"
  fsuid=114
  ouid=114

Before that, I had had the following in its profile:

  /var/log/bind/named.log w,
  /var/log/bind/ rw,

I don't understand why that wasn't correct.
Any explanations would be appreciated.
Should the second line have been "/var/log/bind rw"
instead (i.e. without the trailing slash)?

So I changed it to:

  /var/log/bind/* w,
  /var/log/bind/ rw,

Then the following message started appearing:

  apparmor="DENIED"
  operation="rename_src"
  profile="/usr/sbin/named"
  name="/var/log/bind/named.log"
  pid=624 comm="named"
  requested_mask="r"
  denied_mask="r"
  fsuid=114
  ouid=114

I've never seen operation="rename_src" before.
I would expect rw on /var/log/bind to be enough
for it but it doesn't seem to be.

Can anyone tell what I'm doing wrong and what
I need to change to allow this?

Thanks,
raf