Hi Today, I noticed a new entries related to the logrotate profile. System was slowing down, two files - '/var/log/kern.log' and '/var/log/syslog' - were empty so I checked '/var/log/kern.log.1' file and there was something like this:
Feb 5 11:34:52 t4 kernel: [ 1859.724491] type=1400 audit(1486290891.948:51): apparmor="DENIED" operation="exec" parent=3089 profile="/etc/cron.daily/logrotate" name="/bin/echo" pid=3090 comm="xargs" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 Feb 5 11:34:52 t4 kernel: [ 1859.727569] type=1400 audit(1486290891.948:52): apparmor="DENIED" operation="exec" parent=3093 profile="/etc/cron.daily/logrotate" name="/bin/echo" pid=3094 comm="xargs" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 Feb 5 11:34:52 t4 kernel: [ 1859.735304] type=1400 audit(1486290891.956:53): apparmor="DENIED" operation="exec" parent=3097 profile="/etc/cron.daily/logrotate" name="/bin/echo" pid=3098 comm="xargs" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 Something is wrong with this profile. A couple days ago there was an issue with "/etc/rc?.d/ r," and "/usr/bin/xargs mrix," rules. And now that... So, should I add something like this one to the profile? /bin/echo mrix, It is okay? I think, that maybe logrotate profile should be updated. Best regards.
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
