add aa-eventd to apparmor-utils

[Mathias Gug]

Binary package hint: apparmor

The aa-eventd perl daemon needs the following packages to work :
 * libtimedate-perl
 * libdbd-sqlite3-perl
 * libfile-tail-perl
 * liblocale-gettext-perl

[Kees Cook (kees)]

Additionally, to get AppArmor into main, we will need to get libdbd-sqlite3-perl and libfile-tail-perl into main as well, or find a way around needing them.

[Mathias Gug (mathiaz)]

On Fri, May 25, 2007 at 10:31:14PM -0000, Kees Cook wrote:
> Additionally, to get AppArmor into main, we will need to get libdbd-
> sqlite3-perl and libfile-tail-perl into main as well, or find a way
> around needing them.

aa-eventd scans log files with File::Tail, catches audit messages generated
by AppArmor and dumps them into a sqlite database. The database is then used
by reporting tools (through Reports.pm, currently only Yast is using it).
The reason to use sqlite is for speed : scanning through log files
every time one wants to get information about policy violation is much
slower (according to sarnold).

Additionaly aa-eventd can send notification via email.

[Kees Cook (kees)]

aa-eventd is currently not included in the apparmor-utils package.

[Jamie Strandboge (jdstrand)]

After discussions at UDS Lucid, it was discovered that aa-eventd is not suitable for shipping at this time. It needs a lot of work and there should be better ways of notifying the user. Marking "Won't Fix".