[Apparmor-general] aa-genprof: UNHANDLED

[Andreas Hasenack]

On Friday 15 June 2007 19:11:06 Seth Arnold wrote:
> On Fri, Jun 15, 2007 at 04:45:16PM -0300, Andreas Hasenack wrote:
> > I'm trying aa-genprof on /sbin/rpcbind (portmapper substitute) but get
> > nothing out of it. When enabling debug, I see that all events are
> > tagged as UNHANDLED:
> >
> > (...)
> > UI_Info: text: Reading log entries from /var/log/messages.
> > UI_Info: text: Updating AppArmor profiles in /etc/apparmor.d.
> > UNHANDLED: Jun 15 16:40:53 pandora kernel: audit(1181936453.840:61):
> > PERMITTING w access to /var/run/rpcbind.lock (15782 profile
> > /sbin/rpcbind active /sbin/rpcbind)
>
> Andreas, try adding --with-apparmor to the audit ./configure command.

Hmm, I'm not using audit, so I guess that must be it :)

Thanks

> The userspace side of audit doesn't automatically include all the
> strings for the message id ranges.
>
> Let me know if this doesn't do it, and I'll dig harder ;)
>
> Thanks