logprof: crash if /etc/apparmor/logprof.conf doesn't exist

[reallydont needtoknow]

aa-autodep and aa-logprof both crash and burn. Tried uninstalling apparmor and reinstalling without success.

Why doesn't uninstalling apparmor remove all of it, why are there still lingering files? I imagine this is part of the problem.

[John Johansen (jjohansen)]

Could you provide some more info please? Distro, release, etc.

I am not sure what you uninstalled from the description nor why you believe apparmor was not fully removed but on debian based systems apparmor is broken into several packages.

apparmor - user-space parser utility for AppArmor
apparmor-easyprof - AppArmor easyprof profiling tool
apparmor-notify - AppArmor notification system
apparmor-profiles - experimental profiles for AppArmor security policies
apparmor-utils - utilities for controlling AppArmor
libapparmor-perl - AppArmor library Perl bindings
libapparmor1:amd64 - changehat AppArmor library
python3-apparmor - AppArmor Python3 utility library
python3-libapparmor - AppArmor library Python3 bindings

The kernel will be built with apparmor support and can't be removed without building/installing a kernel without apparmor support, though if the userspace is removed the apparmor kernel module should remain dormant. There are usually some development packages as well. In addition some packages will depend on the apparmor debhelper and will install policy so it is available to use if apparmor is installed, but again those parts will remain dormant if the apparmor userspace is uninstalled.

[Christian Boltz (cboltz)]

Wild guess based on looking at the code in aa.py set_logfile(): Either you don't have /etc/apparmor/logprof.conf, or the file doesn't have "logfiles = ..." in the "[settings]" section.

To verify this, please try aa-logprof -f /var/log/audit/audit.log (assuming this file exists, otherwise try with your syslog as parameter). With "-f", aa-logprof shouldn't crash, or at least crash with a different error message ;-)