logprof/genprof skip logmessages concerning unlink
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
apparmor (Ubuntu) |
Won't Fix
|
Undecided
|
Unassigned |
Bug Description
Applies to: Ubuntu 10.04 with
Linux station1 2.6.32-40-generic #87-Ubuntu SMP Tue Mar 6 00:56:56 UTC 2012 x86_64 GNU/Linux
# apt-cache policy apparmor
apparmor:
Installiert: 2.5.1-0ubuntu0.
Kandidat: 2.5.1-0ubuntu0.
Logprof/Genprof may be used to generate new apparmor profiles.
Logprof/Genprof read /var/log/
Logprof/Genprof ignore some AppArmor messages and the resulting profiles are therefore missing some rules!
In our tests this happened with messages concerning the unlinking of file sockets and pid-files. This can easily be reproduced by removing the supplied mysqld-profile and recreating it from scratch with genprof /usr/sbin/mysqld.
The following message in the log files is ignored:
type=APPARMOR_
Running logprof on the audit-log does not add the rule either:
# logprof /usr/sbin/mysqld
Reading log entries from /var/log/
Updating AppArmor profiles in /etc/apparmor.d.
Another example is Rsyslogd. Create a profile from scratch and the unlinking the pid file is not honored:
type=APPARMOR_
Status changed to 'Confirmed' because the bug affects multiple users.