Hey folks, This bug has been open for a while.
I've created a PPA with a patch that adjusts ausearch's filtering logic to reveal the AppArmor messages: https://launchpad.net/~kicchou/+archive/ubuntu/lp1117804 I'll be updating the LP bug soon with an SRU justification containing that patch. Best, Alex ** Changed in: audit (Ubuntu Jammy) Status: Confirmed => In Progress ** Changed in: audit (Ubuntu Resolute) Status: Confirmed => In Progress ** Changed in: audit (Ubuntu Stonking) Status: Confirmed => In Progress ** Changed in: audit (Ubuntu Noble) Status: Confirmed => In Progress ** Changed in: audit (Ubuntu Noble) Assignee: (unassigned) => Alex Ramirez (kicchou) ** Changed in: audit (Ubuntu Stonking) Assignee: (unassigned) => Alex Ramirez (kicchou) ** Changed in: audit (Ubuntu Resolute) Assignee: (unassigned) => Alex Ramirez (kicchou) ** Changed in: audit (Ubuntu Jammy) Assignee: (unassigned) => Alex Ramirez (kicchou) -- You received this bug notification because you are a member of AppArmor Developers, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1117804 Title: ausearch doesn't show AppArmor denial messages Status in AppArmor: Confirmed Status in audit package in Ubuntu: In Progress Status in linux package in Ubuntu: Invalid Status in audit source package in Jammy: In Progress Status in audit source package in Noble: In Progress Status in audit source package in Questing: Won't Fix Status in audit source package in Resolute: In Progress Status in audit source package in Stonking: In Progress Bug description: The following command should display all AVC denials: ausearch -m avc However, it doesn't work with AppArmor denials. Here's a quick test case to generate a denial, search for it with ausearch, and see that no messages are displayed: $ aa-exec -p /usr/sbin/tcpdump cat /proc/self/attr/current cat: /proc/self/attr/current: Permission denied $ sudo ausearch -m avc -c cat <no matches> ausearch claims that there are no matches, but there's a matching audit message if you look in audit.log: type=AVC msg=audit(1360193426.539:64): apparmor="DENIED" operation="open" parent=8253 profile="/usr/sbin/tcpdump" name="/proc/8485/attr/current" pid=8485 comm="cat" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000 To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1117804/+subscriptions
