Ah I get it, I didn't see the operation="unlink" part back then Thanks John!
On Tue, Jun 17, 2014 at 8:31 AM, John Johansen <[email protected]> wrote: > On 06/16/2014 05:26 PM, Aaron Lewis wrote: >> Hi, >> >> Take a look at the following message >> >> [ 760.181424] type=1400 audit(xxxxxxx:113): apparmor="ALLOWED" >> operation="unlink" parent=1 profile="/usr/sbin/php5-fpm" >> name="/run/php5-fpm.sock" pid=1340 comm="php5-fpm" requested_mask="d" >> denied_mask="d" fsuid=0 ouid=0 >> >> I tried to set the 'd' flag in the profile but it caused a syntax error >> (Running Ubuntu 12.04 everything up-to-date) >> > > The kernel is tracking a wider permission set than the current userspace > policy uses. The d flag is deleted, and the c flag is create, both of > those currently map to the write permission in userspace policy. > > There are plans to enable specifying a finer permission set in userspace > when needed but that work is not ready yet > -- Best Regards, Aaron Lewis - PGP: 0x13714D33 - http://pgp.mit.edu/ Finger Print: 9F67 391B B770 8FF6 99DC D92D 87F6 2602 1371 4D33 -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
