Bug#872726: linux: apparmor doesn't use proper audit event ids

2017-09-09 Thread John Johansen
On 09/09/2017 10:25 AM, intrigeri wrote: > Hi Laurent & everyone else who's listening! > > Laurent Bigonville: >> Le 03/09/17 à 13:01, intrigeri a écrit : >>> Laurent Bigonville: IMVHO, in regard to the recent proposal of enabling apparmor in debian by default, this needs to be addressed

Bug#872726: linux: apparmor doesn't use proper audit event ids

2017-09-09 Thread intrigeri
Hi Laurent & everyone else who's listening! Laurent Bigonville: > Le 03/09/17 à 13:01, intrigeri a écrit : >> Laurent Bigonville: >>> IMVHO, in regard to the recent proposal of enabling apparmor in debian >>> by default, this needs to be addressed first. >> I'm genuinely curious why this should be

Bug#872726: linux: apparmor doesn't use proper audit event ids

2017-09-04 Thread Laurent Bigonville
Le 03/09/17 à 13:01, intrigeri a écrit : Hi Laurent! Hello, Laurent Bigonville: IMVHO, in regard to the recent proposal of enabling apparmor in debian by default, this needs to be addressed first. I'm genuinely curious why this should be a blocker for Debian: this is not obvious to me as a

Bug#872726: linux: apparmor doesn't use proper audit event ids

2017-09-03 Thread intrigeri
Hi Laurent! Laurent Bigonville: > IMVHO, in regard to the recent proposal of enabling apparmor in debian > by default, this needs to be addressed first. I'm genuinely curious why this should be a blocker for Debian: this is not obvious to me as a number of distros could enable AppArmor by default

Bug#872726: linux: apparmor doesn't use proper audit event ids

2017-08-20 Thread Vincas Dargis
This is upstream bug report: https://bugs.launchpad.net/ubuntu/+source/audit/+bug/1117804

Bug#872726: linux: apparmor doesn't use proper audit event ids

2017-08-20 Thread Vincas Dargis
On Sun, 20 Aug 2017 16:42:55 +0200 Laurent Bigonville wrote: IMVHO, in regard to the recent proposal of enabling apparmor in debian by default, this needs to be addressed first. Yes this is very important, although we have aa-logprof to be used as auditing tool, but I agree that not seeing App

Bug#872726: linux: apparmor doesn't use proper audit event ids

2017-08-20 Thread Laurent Bigonville
Source: linux Version: 4.12.6-1 Severity: normal Hi, Currently the code in the kernel is not using the expected audit event ids (it's using the one allocated to SELinux, 1400 to 1499) when it's logging its messages (denials,...). This has been discussed on the linux-audit back to 2014 and again