mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-12 23:37:51 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
apparmor.d/tests/testdata/logs/audit.log
Alexandre Pujol 14a5d8deae
fix(aa-log): ensure we also split quote in log value 
fix #229
2024-10-02 21:06:45 +01:00

58 lines
13 KiB
Text
Raw Permalink Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

type=BPF msg=audit(1111111111.111:1111): prog-id=60 op=LOAD
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="file_inherit" profile="kmod" pid=505701 comm="modprobe" family="unix" sock_type="stream" protocol=0 requested_mask="send receive"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="file_inherit" profile="mkinitcpio" pid=505701 comm="modprobe" family="unix" sock_type="stream" protocol=0 requested_mask="receive"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="file_inherit" profile="pacman" pid=505701 comm="modprobe" family="unix" sock_type="stream" protocol=0 requested_mask="receive"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="file_inherit" profile="pacman-hook-mkinitcpio-install" pid=505701 comm="modprobe" family="unix" sock_type="stream" protocol=0 requested_mask="receive"
type=AVC msg=audit(1111111111.111:1111): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="apparmor_parser" name="firejail-default" pid=509201 comm="apparmor_parser"
type=AVC msg=audit(1111111111.111:1111): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="apparmor_parser" name="firejail-default" pid=509200 comm="apparmor_parser"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="open" profile="aa-log" name="/sys/kernel/mm/transparent_hugepage/hpage_pmd_size" pid=509286 comm="remove-system.m" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0FSUID="user" OUID="user"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="open" profile="sysctl" name="/proc/sys/kernel/panic_on_oops" pid=509859 comm="sysctl" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0FSUID="user" OUID="root"
type=BPF msg=audit(1111111111.111:1111): prog-id=75 op=LOAD
type=AVC msg=audit(1111111111.111:1111): apparmor="DENIED" operation="signal" profile="dbus-daemon" pid=2466 comm="at-spi-bus-laun" requested_mask="receive" denied_mask="receive" signal=term peer="at-spi-bus-launcher"
type=BPF msg=audit(1111111111.111:1111): prog-id=16 op=LOAD
type=BPF msg=audit(1111111111.111:1111): prog-id=17 op=LOAD
type=AVC msg=audit(1111111111.111:1111): apparmor="DENIED" operation="open" profile="dnsmasq" name="/proc/sys/kernel/osrelease" pid=1427 comm="dnsmasq" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root"
type=AVC msg=audit(1111111111.111:1111): apparmor="DENIED" operation="open" profile="dnsmasq" name="/proc/1/environ" pid=1427 comm="dnsmasq" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root"
type=AVC msg=audit(1111111111.111:1111): apparmor="DENIED" operation="open" profile="dnsmasq" name="/proc/cmdline" pid=1427 comm="dnsmasq" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root"
type=AVC msg=audit(1111111111.111:1111): apparmor="STATUS" operation="profile_load" profile="apparmor_parser" name="docker-default" pid=1775 comm="apparmor_parser"
type=BPF msg=audit(1111111111.111:1111): prog-id=18 op=LOAD
type=BPF msg=audit(1111111111.111:1111): prog-id=22 op=LOAD
type=AVC msg=audit(1111111111.111:1111): apparmor="DENIED" operation="open" profile="lsb_release" name="/home/user/" pid=2737 comm="find" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000FSUID="user" OUID="user"
type=AVC msg=audit(1111111111.111:1111): apparmor="DENIED" operation="open" profile="lsb_release" name="/etc/" pid=2737 comm="find" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0FSUID="user" OUID="root"
type=BPF msg=audit(1111111111.111:1111): prog-id=23 op=LOAD
type=AVC msg=audit(1111111111.111:1111): apparmor="DENIED" operation="file_inherit" profile="chromium-chromium" name="/home/user/.local/share/gvfs-metadata/root" pid=8661 comm="chromium" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000FSUID="user" OUID="user"
type=AVC msg=audit(1111111111.111:1111): apparmor="DENIED" operation="file_inherit" profile="chromium-chromium" name="/home/user/.local/share/gvfs-metadata/root-aaabbbc0.log" pid=8661 comm="chromium" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000FSUID="user" OUID="user"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="open" profile="fusermount" name="/run/user/1000/doc/" pid=8703 comm="fusermount" requested_mask="r" denied_mask="r" fsuid=0 ouid=1000FSUID="root" OUID="user"
type=AVC msg=audit(1111111111.111:1111): apparmor="DENIED" operation="open" profile="chrome-gnome-shell" name="/home/user/.netrc" pid=9119 comm="chrome-gnome-sh" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000FSUID="user" OUID="user"
type=BPF msg=audit(1111111111.111:1111): prog-id=26 op=LOAD
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="exec" info="no new privs" error=-1 profile="man" name="/usr/bin/preconv" pid=60755 comm="man" requested_mask="x" denied_mask="x" fsuid=1000 ouid=1000 target="man_groff" FSUID="user" OUID="user"
type=USER_AVC msg=audit(1111111111.111:1111): pid=1648 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="ALLOWED" operation="dbus_method_call" bus="system" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" member="AddMatch" name=":1.3" mask="receive" label="dbus-daemon" peer_pid=1667 peer_label="power-profiles-daemon" exe="/usr/bin/dbus-daemon" sauid=102 hostname=? addr=? terminal=?'UID="messagebus" AUID="unset" SAUID="messagebus"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="file_perm" parent=16001 profile=666F6F20626172 name="/home/foo/.bash_history" pid=17011 comm="bash" requested_mask="rw" denied_mask="rw" fsuid=0 ouid=1000
type=USER_AVC msg=audit(1111111111.111:1111): pid=1648 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="ALLOWED" operation="dbus_method_call" bus="system" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" member="AddMatch" mask="send" name="org.freedesktop.DBus" pid=1667 label="power-profiles-daemon" peer_label="dbus-daemon" exe="/usr/bin/dbus-daemon" sauid=102 hostname=? addr=? terminal=? UID="messagebus" AUID="unset" SAUID="messagebus"
type=USER_AVC msg=audit(1111111111.111:1111): pid=1648 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="ALLOWED" operation="dbus_method_call" bus="system" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" member="AddMatch" name=":1.4" mask="receive" label="dbus-daemon" peer_pid=1 peer_label="unconfined" exe="/usr/bin/dbus-daemon" sauid=102 hostname=? addr=? terminal=?'UID="messagebus" AUID="unset" SAUID="messagebus"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="bind" profile="gnome-shell" pid=2027 comm="gnome-shell" family="unix" sock_type="stream" protocol=0 requested_mask="bind" denied_mask="bind" addr="@/tmp/.X11-unix/X1"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="file_perm" profile="gnome-session-binary" pid=1995 comm="gnome-session-b" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr="@/tmp/.ICE-unix/1995" peer_addr=none peer="gnome-shell"
Sep 6 11:23:47 xubuntu-lts kernel: [ 31.024982] audit: type=1107 audit(1111111111.111:1111): pid=1567 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="ALLOWED" operation="dbus_method_call" bus="system" path="/org/freedesktop/Accounts/User1000" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.Accounts" pid=1693 label="lightdm" peer_pid=1559 peer_label="accounts-daemon"
Sep 6 11:26:12 xubuntu-lts kernel: [ 175.272924] audit: type=1107 audit(1111111111.111:1111): pid=1567 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="ALLOWED" operation="dbus_signal" bus="system" path="/org/freedesktop/Accounts/User1000" interface="org.freedesktop.Accounts.User" member="Changed" name=":1.6" mask="receive" pid=1693 label="lightdm" peer_pid=1559 peer_label="accounts-daemon"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="link" class="file" profile="akonadi_maildispatcher_agent" name="/home/bob/.config/akonadi/agent_config_akonadi_maildispatcher_agent.CmJRGE" pid=19277 comm="akonadi_maildis" requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000 target="/home/bob/.config/akonadi/#3029891" FSUID="user" OUID="user"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="ptrace" class="ptrace" profile="xdg-document-portal" pid=4515 comm="pool-/usr/lib/x" requested_mask="read" denied_mask="read" peer="nautilus"
type=AVC msg=audit(1689957950.207:1952): apparmor="DENIED" operation="file_inherit" class="net" profile="nvidia_modprobe" pid=5139 comm="nvidia-modprobe" family="netlink" sock_type="raw" protocol=0 requested_mask="send receive" denied_mask="send receive"
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1111111111.111:1111): apparmor="ALLOWED" operation="open" class="file" profile="gsettings" name="/var/lib/gdm3/greeter-dconf-defaults" pid=2477 comm="gsettings" requested_mask="r" denied_mask="r" fsuid=131 ouid=131
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(11111111111.111:111): apparmor="ALLOWED" operation="connect" class="net" profile="gsettings" pid=2477 comm=64636F6E6620776F726B6572 family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send receive connect" addr=none peer_addr="@/tmp/dbus-AaKMpxzC4k" peer="dbus-daemon"
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689714302.008:1693): apparmor="ALLOWED" operation="file_perm" class="net" profile="gsettings" pid=2446 comm="dbus-daemon" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr="@/tmp/dbus-AaKMpxzC4k" peer="dbus-daemon"
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689714302.008:1694): apparmor="ALLOWED" operation="file_perm" class="net" profile="gsettings" pid=2446 comm="dbus-daemon" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr="@/tmp/dbus-AaKMpxzC4k" peer="dbus-daemon"
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689714302.008:1695): apparmor="ALLOWED" operation="mkdir" class="file" profile="gnome-keyring-daemon" name="/var/lib/gdm3/.local/" pid=2478 comm="gnome-keyring-d" requested_mask="c" denied_mask="c" fsuid=131 ouid=131
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689714302.008:1696): apparmor="ALLOWED" operation="mkdir" class="file" profile="gnome-keyring-daemon" name="/var/lib/gdm3/.local/share/" pid=2478 comm="gnome-keyring-d" requested_mask="c" denied_mask="c" fsuid=131 ouid=131
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689779263.198:3384): apparmor="DENIED" operation="ptrace" class="ptrace" profile="snap-update-ns.firefox" pid=1948 comm="systemd-journal" requested_mask="readby" denied_mask="readby" peer="systemd-journald"
Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689779263.198:3385): apparmor="DENIED" operation="ptrace" class="ptrace" profile="snap-update-ns.firefox" pid=1948 comm="systemd-journal" requested_mask="readby" denied_mask="readby" peer="systemd-journald"
Jul 19 15:07:43 aa-ubuntu-desktop kernel: [ 160.323577] audit: type=1400 audit(1689779263.106:3379): apparmor="DENIED" operation="capable" class="cap" profile="/snap/snapd/19457/usr/lib/snapd/snap-confine" pid=3915 comm="snap-confine" capability=12 capname="net_admin"
Jul 19 15:07:43 aa-ubuntu-desktop kernel: [ 160.323584] audit: type=1400 audit(1689779263.106:3380): apparmor="DENIED" operation="capable" class="cap" profile="/snap/snapd/19457/usr/lib/snapd/snap-confine" pid=3915 comm="snap-confine" capability=38 capname="perfmon"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="file_inherit" class="net" profile="firefox-vaapitest" pid=5120 comm="vaapitest" family="netlink" sock_type="raw" protocol=0 requested_mask="send receive" denied_mask="send receive"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable" class="cap" profile="/usr/lib/kauth/backlighthelper" pid=2632 comm="backlighthelper" capability=12 capname="net_admin"
profile="sddm-greeter" operation="setsockopt" class="net" comm="sddm-greeter" family="netlink" sock_type="raw" protocol=15 requested_mask="setopt" denied_mask="setopt"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable" class="cap" profile="xorg" pid=16195 comm="Xorg.bin" capability=17 capname="sys_rawio"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="getattr" class="file" profile="pacman//null-/usr/share/code-features/patch.py" name="/etc/ld.so.preload" pid=18817 comm="patch.py" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable" class="cap" info="optional: no audit" error=-1 profile="pacman" comm="killall" capability=19 capname="sys_ptrace"
apparmor="ALLOWED" operation="open" class="file" profile="signal-desktop" name="/sys/devices/pci0000:00/0000:00:02.0/boot_vga" comm="signal-desktop" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 FSUID="user" OUID="root"
apparmor="ALLOWED" operation="link" class="file" profile="startplasma" name="@{user_cache_dirs}/ksycoca5_de_LQ6f0J2qZg4vOKgw2NbXuW7iuVU=.isNSBz" comm="startplasma-way" requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000 target="@{user_cache_dirs}/#@{int}" FSUID="user" OUID="user"
Reference in a new issue View git blame Copy permalink