aa-log mistakes `peer=(name=...)` for `name=...` about apparmor.d HOT 8 CLOSED

You are right, I will update the way dbus logs are printed.

Yes, /var/log/audit/audit.log does not include dbus session entry. As syslog is not present on some distribution (arch), aa-log has an option (-d) to only show dbus session entry using journalctl.

from apparmor.d.

Could you tell me what's the issue here? This is not a mistake, more a representation decision as there is no name= in dbus rules.

The real issue is that aa-log should have removed everything before apparmor="ALLOWED". I will fix this soon.

from apparmor.d.

Because this information is not about profile itself, but about it's neighbor (peer). Known confusion in naming, same with unix's peers and labels. Sure fixing it in the kernel is out of the scope of this project. Maybe name for dbus can be omitted, resulting in something like profile parser wants:

lightdm dbus_signal receive bus=system path=/org/freedesktop/Accounts/User1000 interface=org.freedesktop.Accounts.User member=Changed peer=(name=:1.6, label=accounts-daemon)

The real issue is that aa-log should have removed everything before apparmor="ALLOWED".

Perhaps it's because I passed /var/log/syslog to aa-log. :) Now I see there's no dbus entries in /var/log/audit/audit.log.

from apparmor.d.

A note here. DBus can have name, without peer, but only with bind operation:

type=USER_AVC msg=audit(1662575819.496:1487): pid=2009 uid=0 auid=0 ses=2 subj=? msg='apparmor="ALLOWED" operation="dbus_bind"  bus="session" name="org.freedesktop.impl.portal.PermissionStore" mask="bind" pid=2024 label="xdg-permission-store"  exe="/usr/bin/dbus-daemon" sauid=0 hostname=? addr=? terminal=?'UID="root" AUID="root" SAUID="root"

ALLOWED xdg-permission-store dbus_bind org.freedesktop.impl.portal.PermissionStore bind bus=session

  dbus bind bus=session
       name=org.freedesktop.impl.portal.PermissionStore,

from apparmor.d.

unix:

type=AVC msg=audit(1663014464.673:1689): apparmor="ALLOWED" operation="connect" profile="gnome-control-center" pid=3746 comm="pool-gnome-cont" family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send receive connect" addr=none peer_addr="@/home/testuser/.cache/ibus/dbus-v7Mb0EsW" peer="ibus-daemon"

ALLOWED gnome-control-center connect comm=pool-gnome-cont family=unix sock_type=stream protocol=0 requested_mask="send receive connect" denied_mask="send receive connect" peer=ibus-daemon addr=none peer_addr=@/home/testuser/.cache/ibus/dbus-v7Mb0EsW

unix (send, receive, connect) type=stream peer=(addr="@/home/*/.cache/ibus/dbus-*", label=ibus-daemon),

Total confusion.

from apparmor.d.

Fixed long ago.

from apparmor.d.

Yes, /var/log/audit/audit.log does not include dbus session entry. As syslog is not present on some distribution (arch), aa-log has an option (-d) to only show dbus session entry using journalctl.

The -d switch is obviously succeeded by the -s switch. However, when I tried that I got the error message:

json: cannot unmarshal array into Go struct field systemdLog.MESSAGE of type string

from apparmor.d.

This is usually when the output of journalctl is empty. I still need to fix this (it works find most of the time).

from apparmor.d.