Source: audit Version: 1:4.0.2-2+deb13u1 Severity: normal Tags: patch Dear Maintainer,
As discussed in #872726 (wontfix) already in 2017, "ausearch -m avc" does not find any AVC messages generated by AppArmor. For a long time I thought it simply is not even meant to support anything else except SELinux, but it turns out that is is simply a disagreement between the kernel LSM and audit userspace tools on what event ID numbers should AppArmor use (1400 vs 15xx). So the events are in the audit.log, but ausearch simply ignores them due to parsing errors. This issue was tracked in Ubuntu for over 10 year: https://bugs.launchpad.net/ubuntu/+source/audit/+bug/1117804 and recently finally fixed with a simple patch: https://launchpadlibrarian.net/869061395/lp1117804-resolute-3.debdiff Please consider applying the patch to Debian audit package as well. Although this may be an inelegant workaround, it should not cause any harm, and a proper resolution could take considerable time. It would be fairly important (for security!) to support using the ausearch and aureport tools with AppArmor, which is, after all, Debian’s default MAC/LSM. Thanks. -- System Information: Debian Release: 13.7 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 6.12.107+deb13-amd64 (SMP w/8 CPU threads; PREEMPT) Locale: LANG=fi_FI.UTF-8, LC_CTYPE=fi_FI.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled
