[pkg-apparmor] Bug#912587: apparmor makes dmesg useless

[intrigeri]

Control: reassign -1 firejail

Hi Salvo!

Salvo Tomaselli:
> when apparmor is installed, it emits an incredible amount of
> logs on dmesg, causing actual important stuff from the kernel
> to be missed.

Only if some buggy profiles are enabled.

> Should it even be logging on dmesg?

AppArmor is a LSM and the kernel logs there.

> [299560.719237] audit: type=1400 audit(1541071734.314:10526): apparmor="DENIED" operation="ptrace" profile="firejail-default" pid=13691 comm="TaskSchedulerSi" requested_mask="read" denied_mask="read" peer="firejail-default"
> [299560.719241] audit: type=1400 audit(1541071734.314:10527): apparmor="DENIED" operation="ptrace" profile="firejail-default" pid=13691 comm="TaskSchedulerSi" requested_mask="readby" denied_mask="readby" peer="firejail-default"
> [299560.921678] audit: type=1400 audit(1541071734.518:10528): apparmor="DENIED" operation="ptrace" profile="firejail-default" pid=13691 comm="TaskSchedulerSi" requested_mask="read" denied_mask="read" peer="firejail-default"

⇒ reassigning to firejail.

> For now my solution is to remove apparmor,

I would instead suggest:

  sudo aa-disable /etc/apparmor.d/firejail-default

… until that profile is fixed.

So that in the meantime, you keep benefiting from other AppArmor
profiles :)

@firejail maintainers: happy to help if you wish so!

Cheers,
-- 
intrigeri