Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.debian.bugs.dist > #847870

Bug#872726: linux: apparmor doesn't use proper audit event ids

From Laurent Bigonville <bigon@debian.org>
Newsgroups linux.debian.bugs.dist, linux.debian.kernel
Subject Bug#872726: linux: apparmor doesn't use proper audit event ids
Date 2017-09-04 14:40 +0200
Message-ID <ulYPv-5uO-1@gated-at.bofh.it> (permalink)
References <ugzRL-8iD-7@gated-at.bofh.it> <ulAWS-7Ee-5@gated-at.bofh.it> <ugzRL-8iD-7@gated-at.bofh.it> <ulAWS-7Ee-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw


Le 03/09/17 à 13:01, intrigeri a écrit :
> Hi Laurent!

Hello,
>
> Laurent Bigonville:
>> IMVHO, in regard to the recent proposal of enabling apparmor in debian
>> by default, this needs to be addressed first.
> I'm genuinely curious why this should be a blocker for Debian: this is
> not obvious to me as a number of distros could enable AppArmor by
> default and can apparently live with this bug.
>
> Can you please make it explicit, e.g. describing what exact use cases
> would be harmed by enabling AppArmor by default without fixing this
> bug first?
I think that having the denials of a MAC properly logged is important 
for both people developing their policy and also for intrusion/non 
conformity detection.

If someone wants to send their logs to some logging services 
(ELK/splunk/...) having the messages properly logged/categorized seems 
to be the start here.

Kind regards,

Laurent Bigonville

Back to linux.debian.bugs.dist | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

Bug#872726: linux: apparmor doesn't use proper audit event ids Laurent Bigonville <bigon@debian.org> - 2017-08-20 17:00 +0200
  Bug#872726: linux: apparmor doesn't use proper audit event ids Vincas Dargis <vindrg@gmail.com> - 2017-08-20 19:10 +0200
  Bug#872726: linux: apparmor doesn't use proper audit event ids Vincas Dargis <vindrg@gmail.com> - 2017-08-20 19:10 +0200
  Bug#872726: linux: apparmor doesn't use proper audit event ids intrigeri <intrigeri@debian.org> - 2017-09-03 13:10 +0200
    Bug#872726: linux: apparmor doesn't use proper audit event ids Laurent Bigonville <bigon@debian.org> - 2017-09-04 14:40 +0200
      Bug#872726: linux: apparmor doesn't use proper audit event ids intrigeri <intrigeri@debian.org> - 2017-09-09 19:30 +0200
        Bug#872726: linux: apparmor doesn't use proper audit event ids John Johansen <john.johansen@canonical.com> - 2017-09-09 22:20 +0200

csiph-web