OpenSuSE 11.3 and AppArmor

[Rich Braun]

Ever since I started using 11.3 in our test environment, I get several of
these syslog messages per hour on every machine:

Aug 19 20:47:11 dlistqa02 kernel: [15775.810020] type=1503
audit(1282265231.970:83): operation="change_hat" info="unconfined" error=-1
pid=21187

The only hint as to where these come from is a pid at the end of the line:  su
or sshd or the like.  Googling for this error is no use, I don't have any idea
what "change_hat" is or even why I persist in allowing OpenSuSE to install
AppArmor for me.  Each time I uprev OpenSuSE to a new release, I have to spend
hours looking up obscure but apparently innocuous error messages coming from
pam and/or AppArmor.

Short of shutting off AppArmor, how might I eliminate or at least suppress
these errors?  And for those of you who suggest RTFM, where do I find TFM?

-rich