apparmor/utils/notify.conf

# ------------------------------------------------------------------
#
#    Copyright (C) 2010 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

# Set to 'no' to disable AppArmor notifications globally
show_notifications="yes"

# OPTIONAL - restrict using aa-notify to users in the given group
# (if not set, everybody who has permissions to read the logfile can use it)
# use_group="admin"
add utils/apparmor-notify and utils/notify.conf, but don't install yet 2010-01-28 10:25:09 -06:00			`# ------------------------------------------------------------------`
			`#`
			`# Copyright (C) 2010 Canonical Ltd.`
			`#`
			`# This program is free software; you can redistribute it and/or`
			`# modify it under the terms of version 2 of the GNU General Public`
			`# License published by the Free Software Foundation.`
			`#`
			`# ------------------------------------------------------------------`

Default apparmor_notify to report messages, when it is installed and started. Since apparmor_notify is not installed by default and not started by default, the act of installing and starting it implies the desire to get messages. 2010-09-09 10:31:45 -07:00			`# Set to 'no' to disable AppArmor notifications globally`
			`show_notifications="yes"`
add utils/apparmor-notify and utils/notify.conf, but don't install yet 2010-01-28 10:25:09 -06:00
comment out use_group to remove group restrictions use_group is only honored if it is defined. The "real" permission check is reading the logfile - the group check in aa-notify is just an annoying additional check, and the default "admin" only works on Ubuntu (other distributions typically use "wheel"). This commit comments out use_group in the default config, which allows everybody to use aa-notify. Permissions for reading the log file are of course still needed. PR: https://gitlab.com/apparmor/apparmor/merge_requests/82 References: https://bugzilla.opensuse.org/show_bug.cgi?id=1058787 (cherry picked from commit 86ec3dd658349ec5fe6406850ecd282b7dc9cdb2) Acked-by: Christian Boltz <apparmor@cboltz.de> Signed-off-by: John Johansen <john.johansen@canonical.com> 2018-03-18 19:49:59 +01:00			`# OPTIONAL - restrict using aa-notify to users in the given group`
			`# (if not set, everybody who has permissions to read the logfile can use it)`
			`# use_group="admin"`