Fun stuff. Got bitten by this for rsyslogd now.
LibreNMS has an rsyslog config to log through its syslog.php:
if $syslogpriority < 7 then action(type="omprog"
binary="/srv/librenms/syslog.php" template="librenms")
That should be easy to allow:
/usr/bin/php* ix,
/usr/bin/stty ix,
/etc/php/** r,
/srv/librenms/syslog.php ix,
/srv/librenms/** rwk,
/{,var/}run/mysqld/mysqld.sock rw,
But alas, the connect to mysqld.sock fails with:
audit: type=1400 audit(1736955305.142:295109): apparmor="DENIED"
operation="connect" class="file" info="Failed name lookup - disconnected
path" error=-13 profile="rsyslogd" name="run/mysqld/mysqld.sock"
pid=680226 comm="php" requested_mask="wr" denied_mask="wr" fsuid=104
ouid=111
There are two ways to work around that:
- instead of DB_HOST=localhost (which implies unix socket), set
DB_HOST=127.0.0.1 so we get TCP, which works
- add `flags=(attach_disconnected)` to the rsyslog profile (which is
maintained in the rsyslog package)
Is there a better way?
Cheers,
Walter Doekes
OSSO B.V.
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1373070
Title:
full fix for disconnected path (paths)
Status in cups package in Ubuntu:
Fix Released
Status in linux package in Ubuntu:
Triaged
Status in rsyslog package in Ubuntu:
Confirmed
Bug description:
With the apparmor 3 RC1 upload, there is an incomplete bug fix for
disconnected paths. This bug is to track that work.
This denial may be related:
Sep 23 10:10:50 localhost kernel: [40262.517799] audit: type=1400
audit(1411485050.722:2862): apparmor="DENIED" operation="sendmsg" info="Failed
name lookup - disconnected path" error=-13 profile="/usr/sbin/rsyslogd"
name="dev/log" pid=7011 comm="logger" requested_mask="r" denied_mask="r"
fsuid=0 ouid=0
This is related to bug 1375410
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1373070/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
