OpenSuSE 11.3 and AppArmor

[ccb-HInyCGIudOg at public.gmane.org (Charlie Bennett)]

On Thu, 2010-08-19 at 20:55 -0400, Rich Braun wrote:
> Ever since I started using 11.3 in our test environment, I get several of
> these syslog messages per hour on every machine:
> 
> Aug 19 20:47:11 dlistqa02 kernel: [15775.810020] type=1503
> audit(1282265231.970:83): operation="change_hat" info="unconfined" error=-1
> pid=21187
> 
> The only hint as to where these come from is a pid at the end of the line:  su
> or sshd or the like.  Googling for this error is no use, I don't have any idea
> what "change_hat" is or even why I persist in allowing OpenSuSE to install
> AppArmor for me.  Each time I uprev OpenSuSE to a new release, I have to spend
> hours looking up obscure but apparently innocuous error messages coming from
> pam and/or AppArmor.
> 
> Short of shutting off AppArmor, how might I eliminate or at least suppress
> these errors?  And for those of you who suggest RTFM, where do I find TFM?
> 
> -rich
> 


man auditd
man auditd.conf
man audit.rules

ccb

> _______________________________________________
> Discuss mailing list
> Discuss-mNDKBlG2WHs at public.gmane.org
> http://lists.blu.org/mailman/listinfo/discuss