If we add carrot ^ in ranges or sets - we can negate them.
http[^s] - http is not followed by s. Example:
egrep 'http[^s]' /etc/ipp-usb/ipp-usb.conf
Output:
http-min-port = 60000
http-max-port = 65535
# trace-ipp, trace-escl, trace-http - very detailed per-protocol traces
Or another example - after slash / it shound't be lowercase letter:
egrep '/[^a-z]' /etc/apparmor/parser.conf
Output:
# match-string "pattern=aadfa audit perms=crwxamlk/ user::other"
### https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorpolicyfeaturesabi