On Fri, Sep 28, 2007 at 03:39:24PM -0000, Laurent Bonnaud wrote:
> - the operation="ptrace" messages are still there:
>
> [13738.636128] audit(1190992825.243:5): type=1504 operation="ptrace" task=10131 parent=10133 pid=10133 profile="/usr/sbin/nscd"
Correct. The message type is 1504, which is an AppArmor Hint message.
It's used by the log parser tools to generate profiles. As the profile
is in complain mode, it's supposed to generate that kind of message so
that a proper profile can be generated from the log messages.
Turning the profile into enforce mode may fix the messages.
On Fri, Sep 28, 2007 at 03:39:24PM -0000, Laurent Bonnaud wrote: 5.243:5) : type=1504 operation="ptrace" task=10131 parent=10133 pid=10133 profile= "/usr/sbin/ nscd"
> - the operation="ptrace" messages are still there:
>
> [13738.636128] audit(119099282
Correct. The message type is 1504, which is an AppArmor Hint message.
It's used by the log parser tools to generate profiles. As the profile
is in complain mode, it's supposed to generate that kind of message so
that a proper profile can be generated from the log messages.
Turning the profile into enforce mode may fix the messages.
status triaged
--
Mathias