mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

AppArmor_Failures: fix up log format

Steve Beattie 2017-11-03 22:49:16 -07:00
parent 5f9028a0b3
commit d8b5a10bf4
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
AppArmor_Failures.md

@ -72,7 +72,7 @@ is setup but are usually in one or more of the following locations:
A typical denied message looks like the following:
`type=APPARMOR\_ALLOWED msg=audit(1212396827.141:861): operation=“inode\_unlink” requested\_mask=“w” denied\_mask=“w” name=“/tmp/orbit-jj/linc-e6e-0-2acdd337d87e5” pid=3694 profile=“/usr/bin/foo”`
type=APPARMOR\_ALLOWED msg=audit(1212396827.141:861): operation=“inode\_unlink” requested\_mask=“w” denied\_mask=“w” name=“/tmp/orbit-jj/linc-e6e-0-2acdd337d87e5” pid=3694 profile=“/usr/bin/foo”
Notice the 'denied\_mask' in the above log entry. auditd will use
'DENIED' instead. In general, you can use one of (as root):