Useless "null-complain-profile" warnings flood dmesg log

[LimCore]

Ubuntu 9.04 amd64 up-to-date
ii apparmor 2.3+1289-0ubuntu14
Linux 2.6.28-13-generic

I use custom apparmor profiles.

In my dmesg I get TONS of:

[12001.130755] type=1502 audit(1251569353.918:266455): operation="socket_recvmsg" family="inet" sock_type="stream" protocol=6 pid=19145 profile="null-complain-profile"

[12001.135599] type=1502 audit(1251569353.922:266456): operation="socket_recvmsg" family="inet" sock_type="stream" protocol=6 pid=19145 profile="null-complain-profile"

like 100 per minute.

The problem: There is NO INFORMATION what is this.. so no hint how to debug it and remove the profile that causes this problem! Also googling doesnt help.

Please fix:
  1. give more explanation
  2. point AT LEAST to the program/PID that causes this!

[Jamie Strandboge (jdstrand)]

Can you run:
$ sudo apport-collect -p apparmor 421216

Please see /usr/share/apport/package-hooks/source_apparmor.py for details on what this command will provide.

[Jaymie Lee (plainjane2u)]

Architecture: i386
DistroRelease: Ubuntu 9.10
Package: apparmor 2.3.1+1403-0ubuntu27.3
PackageArchitecture: i386
ProcCmdline: root=UUID=d86ee1ed-eb47-4134-9fbe-e128366460c9 ro quiet splash
ProcEnviron:
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-20.58-generic
Uname: Linux 2.6.31-20-generic i686
UserGroups: adm admin audio cdrom dialout dip fax fuse lpadmin netdev plugdev pulse root sambashare scanner tape video

[alex dekker (ubuntu-ale)]

This also started happening to me after I installed syslog-ng on 8.04LTS.

[alex dekker (ubuntu-ale)]

Sorry, scratch that last comment, it's Logzilla's DB insert script, called by php-syslog-ng, that causes apparmor to go nuts with the logging.

[Kees Cook (kees)]

these messages are likely the result of profiles running in "complain" mode that start new child processes. Tracing these in Lucid should be much easier, as the "null" profiles are numbered so the audit tools can understand where they're coming from.