About Apparmor's audit log format
I'm analyzing audit log generated by learning mode of Apparmor. Like under logs:
Jul 11 02:43:25 nanjing kernel: audit(1184147005.032:617870383):
PERMITTING mrw access to /var/opt/teradata/tdtemp/pdesegments3.dat
(actmain(20792) profile null-complain-profile active null-complain-profile)
Jul 11 02:43:25 nanjing kernel: audit(1184147005.036:617870384):
PERMITTING mrw access to /var/opt/teradata/tdtemp/pdesegments3.dat
(actmain(20792) profile null-complain-profile active null-complain-profile)
Why there is "null-complain-profile active" sometime and a absoulte path name of a executable file?
Thanks.
|