Comment 4 for bug 872446

Revision history for this message
Steve Beattie (sbeattie) wrote : Re: aa-logprof should detect denials as well as complaints

So the issue here is that, due to logprof not taking into account some logging changes, it was dropping 'exec' events that occurred when the profile in question was in enforcing mode; it would catch it if it was in complain mode (because of the generated null profile on exec in complain mode). I've sent a patch for review to the upstream mailing list: https://lists.ubuntu.com/archives/apparmor/2012-March/002519.html .

However, with just that patch applied, I get a couple of perl warnings that patch 3/4 in that series addresses.