Logwatch / Patches / #31 Update for audit service to unmatched apparmor entries

Update for audit service to unmatched apparmor entries

#31 Update for audit service to unmatched apparmor entries

Milestone: Unstable (example)

Status: closed

Owner: Stefan Jakobs

Labels: None

Priority: 5

Updated: 2014-09-09

Created: 2013-05-28

Creator: Chris

Private: No

Noticed this reported unmatched entries:

https://sourceforge.net/tracker/?func=detail&aid=3613992&group_id=312875&atid=1316824

while using logwatch with apparmor logging and created the attached patch to match them. Maybe there is a better way to match them, suggestions are welcome.

Discussion

Chris - 2013-05-28

Fix for unmatched apparmor entries

audit.patch

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Chris - 2013-05-30

Optimized version of the patch

audit_v2.patch

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Chris - 2013-05-30

Just added a new patch v2 to match one more line like:

type=1400 audit(1369779761.479:740756): apparmor="ALLOWED" operation="getattr" info="Failed name lookup - deleted entry" error=-2 parent=1 profile="/usr/sbin/dovecot//null-1c//null-1d" name="/var/lib/dovecot/.temp.3733.713cbcb0f36ad061" pid=3733 comm="dovecot" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

Additional i've merged the two regexes to one and only print out the count of the ALLOWED lines.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Stefan Jakobs - 2014-09-09

status: open --> closed

assigned_to: Stefan Jakobs

Group: --> Unstable (example)
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Stefan Jakobs - 2014-09-09

Thanks. Commited: rev223

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Update for audit service to unmatched apparmor entries

Group

Searches

Help

#31 Update for audit service to unmatched apparmor entries

Discussion