Comment 16 for bug 340183

On Sat, Mar 14, 2009 at 01:37:02PM -0000, Dariusz Suchojad wrote:
> apparmor | auditd | OK? |
> ---------------------------------------------------------------------------
> 2.3+1289-0ubuntu4.11.7.4-1 | n/a | no |
> 2.3+1289-0ubuntu4.11.7.4-1 | 1.7.4-1 | yes |

Can you tell me where the above apparmor version came
from? I don't see it on the list of published packages at
https://launchpad.net/ubuntu/+source/apparmor .

> 2.3+1289-0ubuntu4.2~ppa1 | n/a | no |
> 2.3+1289-0ubuntu4.2~ppa1 | 1.7.4-1 | yes |
> 2.3+1289-0ubuntu4.2~ppa1 (-f /var/log/messages) | n/a | no |

Can you make sure you're updating libapparmor1 at the same time? As
that's where I believe the issue is located. IIRC, the packaging is set
up so that there is not a tight version dependency between the various
packages, and so upgrading the apparmor package won't pull in the
libapparmor1 update by default.

('dpkg -l "*apparmor*" auditd libaudit0' will report versions for all
the apparmor and audit packages installed.)

> What I don't understand is why aa-genprof doesn't mark the logs with a beginning
> marker to know where to start reading messages from? I.e. the first line in logs
> after starting aa-genprof is
>
> Mar 14 14:19:03 xerxes kernel: [ 2827.572460] type=1505
> audit(1237036743.070:36316): operation="profile_load"
> name="/home/dsuch/bin/ea.sh" name2="default" pid=11641
>
> Shouldn't there always be a GenProf marker first?

You should see something like

  Mar 14 11:13:56 jj-amd64 ubuntu: GenProf: 4995bc33fda53c4f5f9b324c2ccff407

in /var/log/messages, at least when auditd is not running.

Ah, I see one additional problem, if /var/log/audit/audit.log exists,
even if auditd is not running, genprof won't write the marker. Hrm.

--
Steve Beattie
<email address hidden>
http://NxNW.org/~steve/