Base abstraction for writing to the systemd journal doesn't work

[Mark Wadham]

The base abstractions file contains:

  /{,var/}run/systemd/journal/dev-log w,

and the usr.lib.dovecot.log profile includes this:

#include <tunables/global>

/usr/lib/dovecot/log flags=(complain) {
  #include <abstractions/base>
  #include <abstractions/dovecot-common>

  /usr/lib/dovecot/log mr,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/usr.lib.dovecot.log>
}

but it doesn't seem to work, despite reloading the profile I get:

Jul 23 11:23:40 a kernel: [69753.983562] audit: type=1400 audit(1469269420.312:14712): apparmor="ALLOWED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/log" name="run/systemd/journal/dev-log" pid=6223 comm="log" requested_mask="w" denied_mask="w" fsuid=0 ouid=0

[Christian Boltz (cboltz)]

Sounds like you'll need to add
    flags=(attach_disconnected)
to your dovecot/log profile.

Interestingly, I've never seen this (I'm using dovecot on several openSUSE servers), so I wonder if it is specific to your system or if we need to adjust the official profile.

[intrigeri (intrigeri)]

Mark, ping?

Christian: perhaps your servers don't start dovecot with the same namespacing (done e.g. by systemd) as Mark's :)

[Christian Boltz (cboltz)]

There was another report about this, see bug 1652131. I already added the attach_disconnected flag while fixing that one ;-)