aa-genprof can't parse logs
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| apparmor (Ubuntu) |
Fix Released
|
Medium
|
Unassigned | ||
Bug Description
Binary package hint: apparmor-utils
After upgrading, aa-genprof in gutsy never finds any events.
I tried with "export LOGPROF_DEBUG=1", and the resulting log contained lines like this:
read_log UNHANDLED: Sep 17 19:54:57 nono kernel: [ 7904.712000] audit(119005529
Did the format of the messages from the kernel change?
This is with the latest apparmor-utils:
$ dpkg --status apparmor-utils
Package: apparmor-utils
Status: install ok installed
Priority: extra
Section: base
Installed-Size: 1696
Maintainer: Ubuntu MOTU Developers <email address hidden>
Architecture: i386
Source: apparmor
Version: 2.1+961-0ubuntu5
...
$ uname -a
Linux nono 2.6.22-11-generic #1 SMP Fri Sep 7 05:07:05 GMT 2007 i686 GNU/Linux
Related branches
| Mathias Gug (mathiaz) wrote Re: [Bug 140508] aa-genprof can't parse logs | #1 |
| Changed in apparmor: | |
| importance: | Undecided → Medium |
| status: | New → Triaged |
| Kees Cook (kees) wrote | #2 |
| Changed in apparmor: | |
| status: | Triaged → Fix Released |
On Mon, Sep 17, 2007 at 07:13:11PM -0000, Thomas Leonard wrote:
> Did the format of the messages from the kernel change?
>
Thanks for taking the time to report the bug. It's a problem with the new
kernel module that doesn't sent the correct audit messages to syslog.
There is a patch for the kernel module that should be merged soon.
status triaged
importance medium