AppArmor denial for /usr/bin/pinentry-gtk-2 triggers OSSEC alert

[eloquence]

On my long-running production instance, which is on 0.12.1 and which I upgraded from Trusty to Xenial shortly after 0.12.0 was released, I see the following alerts in my OSSEC logs:

OSSEC HIDS Notification.
2019 Apr 18 16:53:37

Received From: (app) 10.20.2.2->/var/log/syslog
Rule: 100012 fired (level 7) -> "Apparmor denied event"
Portion of the log(s):

Apr 18 16:53:36 app kernel: [ 4710.740829] audit: type=1400 audit(1555631616.202:14):
 apparmor="DENIED" operation="exec" profile="/usr/sbin/apache2" 
 name="/usr/bin/pinentry-gtk-2" pid=3872 comm="gpg-agent" requested_mask="x"
 denied_mask="x" fsuid=33 ouid=0

I see the first one on April 7, and then a batch around the time that I did a lot of testing of deletion via the Journalist Interface. I will attempt to get a clean repro through a submit->delete cycle.

@emkll has reported also seeing this error during 0.12.2 testing.

[emkll]

Based my local testing, pintentry-gtk gets installed on upgrades (Trusty->Xenial), whereas pinentry-curses is installed on clean Xenial installs.

[eloquence]

That corresponds with the package installation report in #4163.

[eloquence]

I can confirm that simply deleting a source triggers this alert for me (on 0.12.1). Steps to reproduce:

1. Submit message or document as a new source
2. Delete the newly created source through the Journalist Interface

Expected behavior:

Source is deleted

Actual behavior:

Source is deleted, but I receive an OSSEC alert as described in the issue