Cannot send message to systemd-journald

[Mark Shuttleworth]

Am seeing these in syslog with a snap in development:

kernel: [724315.080821] audit: type=1400 audit(1471715344.073:5025): apparmor="DENIED" operation="sendmsg" profile="snap.XXX" name="/run/systemd/journal/socket" pid=16971 comm="XXX" requested_mask="w" denied_mask="w" fsuid=1000 ouid=0
kernel: [724331.038037] audit: type=1400 audit(1471715360.029:5026): apparmor="DENIED" operation="sendmsg" profile="snap.XXX.YYY" name="/run/systemd/journal/socket" pid=16987 comm="YYY" requested_mask="w" denied_mask="w" fsuid=1000 ouid=0

I think all that is required is an interface which adds the ability to sendmsg to the systemd-journald socket.

[Jamie Strandboge (jdstrand)]

This can probably simply be added to the log-observe interface, but I'll investigate and determine the appropriate place.

[Jamie Strandboge (jdstrand)]

Oh, this is actually writing to the log, not observing it, so probably should add to the default template (we already allow writing to /dev/log).

[Mark Shuttleworth (sabdfl)]

Thanks Jamie, I would be happy with it being a small additional
interface ('system-log' or similar) if you choose that approach, too.

Mark

[Jamie Strandboge (jdstrand)]

FYI, /run/systemd/journal/socket is the equivalent of /dev/log but for the native systemd journal API and as such, write access should be included by default just like /dev/log is.

[Jamie Strandboge (jdstrand)]

2.20 fixes this issue.