mir/apparmor - apparmor - Mike's Git repositories

mir/apparmor

mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 10:07:12 +00:00

2 lines

255 B

Plaintext

Raw Normal View History

Handle `symlink` log events in aa-logprof Nobody told the tools that log events with operation="symlink" exist. Add this keyword to the list of file or network operations (I don't expect network symlinks ;-) but keeping everything in that list makes things easier than special-casing it.) Also add the log sample and expected result to the libapparmor tests. Fixes https://gitlab.com/apparmor/apparmor/-/issues/107

2020-08-02 19:49:18 +02:00

Aug  3 00:00:41 liuchao-virtual-machine kernel: [ 4362.615262] audit: type=1400 audit(1596384041.705:290): apparmor="DENIED" operation="symlink" profile="/home/test.sh" name="/home/b.c" pid=8016 comm="ln" requested_mask="c" denied_mask="c" fsuid=0 ouid=0