2 AppArmorJournald

Christian Boltz edited this page 2022-02-04 22:14:57 +01:00

Table of Contents

• Introduction
• AppArmor tools
• 1. Redirect systemd logout into aa-logprof
• 2. Install auditd
• 3. enable forwarding to syslog

Introduction

???

AppArmor tools

Some versions of the AppArmor tools do not directly support systemd journal. When this is the case, there are 3 possible workarounds that will enable the use of the AppArmor tools on such a system.

1. Redirect systemd logout into aa-logprof

aa-logprof -f <(journalctl -b --no-tail | grep -i apparmor)

or when using sudo

sudo bash -c "aa-logprof -f <(journalctl -b --no-tail | grep -i apparmor)"

2. Install auditd

If auditd is installed and enabled, AppArmor messages will then go to the audit log which is directly supported by the AppArmor tools.

3. enable forwarding to syslog

If there is a syslog daemon running on the system, journald can forward log messages to syslog. Edit the journald conf

sudo nano /etc/systemd/journald.conf

and add

...
[Journal]
ForwardToSyslog=yes
MaxLevelSyslog=debug

aa-logprof can then pickup the messages from the syslog.