Hi.
I've noticed that apparmor loads /usr/sbin/rsyslogd profile for completely unrelated processes:
Feb 25 08:36:19 emma kernel: [ 134.796218] audit: type=1400 audit(1424842579.429:245): apparmor="DENIED" operation="sendmsg" profile="/usr/sbin/rsyslogd" name="/dev/log" pid=4002 comm="sshd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Feb 25 08:36:23 emma kernel: [ 139.330989] audit: type=1400 audit(1424842583.965:246): apparmor="DENIED" operation="sendmsg" profile="/usr/sbin/rsyslogd" name="/dev/log" pid=4080 comm="sudo" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Feb 25 08:35:42 emma kernel: [ 97.912402] audit: type=1400 audit(1424842542.565:241): apparmor="DENIED" operation="sendmsg" profile="/usr/sbin/rsyslogd" name="/dev/log" pid=2436 comm="whoopsie" requested_mask="r" denied_mask="r" fsuid=103 ouid=0 Feb 25 08:34:43 emma kernel: [ 38.867998] audit: type=1400 audit(1424842483.546:226): apparmor="DENIED" operation="sendmsg" profile="/usr/sbin/rsyslogd" name="/dev/log" pid=3762 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
I'm not sure how apparmor decides which profile to use for which task, but is shouldn't load '/usr/sbin/rsyslogd' profile for sshd/ntpd/etc.
I'm running: # lsb_release -rd Description: Ubuntu 14.04.2 LTS Release: 14.04
# dpkg -l | grep apparmor ii apparmor 2.8.95~2430-0ubuntu5.1 amd64 User-space parser utility for AppArmor ii apparmor-profiles 2.8.95~2430-0ubuntu5.1 all Profiles for AppArmor Security policies ii apparmor-utils 2.8.95~2430-0ubuntu5.1 amd64 Utilities for controlling AppArmor ii libapparmor-perl 2.8.95~2430-0ubuntu5.1 amd64 AppArmor library Perl bindings ii libapparmor1:amd64 2.8.95~2430-0ubuntu5.1 amd64 changehat AppArmor library ii python3-apparmor 2.8.95~2430-0ubuntu5.1 amd64 AppArmor Python3 utility library ii python3-libapparmor 2.8.95~2430-0ubuntu5.1 amd64 AppArmor library Python3 bindings
# uname -a Linux emma 3.16.0-31-generic #41~14.04.1-Ubuntu SMP Wed Feb 11 19:30:13 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
Hi.
I've noticed that apparmor loads /usr/sbin/rsyslogd profile for completely unrelated processes:
Feb 25 08:36:19 emma kernel: [ 134.796218] audit: type=1400 audit(142484257 9.429:245) : apparmor="DENIED" operation="sendmsg" profile= "/usr/sbin/ rsyslogd" name="/dev/log" pid=4002 comm="sshd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 3.965:246) : apparmor="DENIED" operation="sendmsg" profile= "/usr/sbin/ rsyslogd" name="/dev/log" pid=4080 comm="sudo" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 2.565:241) : apparmor="DENIED" operation="sendmsg" profile= "/usr/sbin/ rsyslogd" name="/dev/log" pid=2436 comm="whoopsie" requested_mask="r" denied_mask="r" fsuid=103 ouid=0 3.546:226) : apparmor="DENIED" operation="sendmsg" profile= "/usr/sbin/ rsyslogd" name="/dev/log" pid=3762 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Feb 25 08:36:23 emma kernel: [ 139.330989] audit: type=1400 audit(142484258
Feb 25 08:35:42 emma kernel: [ 97.912402] audit: type=1400 audit(142484254
Feb 25 08:34:43 emma kernel: [ 38.867998] audit: type=1400 audit(142484248
I'm not sure how apparmor decides which profile to use for which task, but is shouldn't load '/usr/sbin/ rsyslogd' profile for sshd/ntpd/etc.
I'm running:
# lsb_release -rd
Description: Ubuntu 14.04.2 LTS
Release: 14.04
# dpkg -l | grep apparmor 2430-0ubuntu5. 1 amd64 User-space parser utility for AppArmor 2430-0ubuntu5. 1 all Profiles for AppArmor Security policies 2430-0ubuntu5. 1 amd64 Utilities for controlling AppArmor 2430-0ubuntu5. 1 amd64 AppArmor library Perl bindings 2430-0ubuntu5. 1 amd64 changehat AppArmor library 2430-0ubuntu5. 1 amd64 AppArmor Python3 utility library 2430-0ubuntu5. 1 amd64 AppArmor library Python3 bindings
ii apparmor 2.8.95~
ii apparmor-profiles 2.8.95~
ii apparmor-utils 2.8.95~
ii libapparmor-perl 2.8.95~
ii libapparmor1:amd64 2.8.95~
ii python3-apparmor 2.8.95~
ii python3-libapparmor 2.8.95~
# uname -a
Linux emma 3.16.0-31-generic #41~14.04.1-Ubuntu SMP Wed Feb 11 19:30:13 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux