On 06/16/2014 05:26 PM, Aaron Lewis wrote: > Hi, > > Take a look at the following message > > [ 760.181424] type=1400 audit(xxxxxxx:113): apparmor="ALLOWED" > operation="unlink" parent=1 profile="/usr/sbin/php5-fpm" > name="/run/php5-fpm.sock" pid=1340 comm="php5-fpm" requested_mask="d" > denied_mask="d" fsuid=0 ouid=0 > > I tried to set the 'd' flag in the profile but it caused a syntax error > (Running Ubuntu 12.04 everything up-to-date) >
The kernel is tracking a wider permission set than the current userspace policy uses. The d flag is deleted, and the c flag is create, both of those currently map to the write permission in userspace policy. There are plans to enable specifying a finer permission set in userspace when needed but that work is not ready yet -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
