Public bug reported:
When enabling the imfile module in order to watch
/var/log/audit/audit.log file, the following traces are generated in
logs regularly :
type=AVC msg=audit(1741370794.968:9963561): apparmor="DENIED" operation="open"
profile="rsyslogd" name="/" pid=67348 comm="in:imfile" requ
** Attachment added: "rsyslog.tar.gz"
https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/2101180/+attachment/5863328/+files/rsyslog.tar.gz
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2101180
Hello Andreas,
Thanks for looking at that bug.
Here is attached the rsyslog config
Thanks !
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2101180
Title:
Multiple DENIED apparmor messages when usi
Hello Ryan,
Yes imfile is working as expected => Syslog flow is correctly generated
to the remote syslog connector.
Thanks !
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2101180
Title:
Multiple D
Hello Andreas,
I confirm that apparmor profile fix is working. No more warning in
audit.log and imfile still does his job.
Please note, I let in the profile the line /var/log/** r, which was
already there.
Thanks !
--
You received this bug notification because you are a member of Ubuntu
Bugs,
