"aa-genprof /usr/sbin/nginx" crashed upon readling a line from a log

Bug #1586232 reported by root
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
AppArmor
New
Undecided
Unassigned
apparmor (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

So (not knowing much about apparmor), to me it looks like AppArmor changed the word "receive" to "reweive" and thought it was a mode.

The entire automatically generated bug report is attached.

Here's my terminal's output:

[root at localhost]:/etc/apparmor.d# aa-genprof /usr/sbin/nginx
Writing updated profile for /usr/sbin/nginx.
Setting /usr/sbin/nginx to complain mode.

Before you begin, you may wish to check if a
profile already exists for the application you
wish to confine. See the following wiki page for
more information:
http://wiki.apparmor.net/index.php/Profiles

Please start the application to be profiled in
another window and exercise its functionality now.

Once completed, select the "Scan" option below in
order to scan the system logs for AppArmor events.

For each AppArmor event, you will be given the
opportunity to choose whether the access should be
allowed or denied.

Profiling: /usr/sbin/nginx

[(S)can system log for AppArmor events] / (F)inish
Reading log entries from /var/log/syslog.
Updating AppArmor profiles in /etc/apparmor.d.
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/apparmor/logparser.py", line 402, in read_log
    self.add_event_to_tree(event)
  File "/usr/lib/python3/dist-packages/apparmor/logparser.py", line 206, in add_event_to_tree
    e = self.parse_event_for_tree(e)
  File "/usr/lib/python3/dist-packages/apparmor/logparser.py", line 303, in parse_event_for_tree
    raise AppArmorException(_('Log contains unknown mode %s') % rmask)
apparmor.common.AppArmorException: 'Log contains unknown mode reweive'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/sbin/aa-genprof", line 151, in <module>
    lp_ret = apparmor.do_logprof_pass(logmark, passno)
  File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 2189, in do_logprof_pass
    log = log_reader.read_log(logmark)
  File "/usr/lib/python3/dist-packages/apparmor/logparser.py", line 407, in read_log
    raise AppArmorBug(ex_msg) # py3-only: from None
apparmor.common.AppArmorBug: Log contains unknown mode reweive

This error was caused by the log line:
May 27 12:51:51 localhost kernel: [1896557.253647] audit: type=1400 audit(1464317511.752:362): apparmor="ALLOWED" operation="file_perm" profile="/usr/sbin/nginx" pid=13215 comm="nginx" laddr=45.32.xxx.xxx lport=443 faddr=101.174.xxx.xxx fport=62972 family="inet" sock_type="stream" protocol=6 requested_mask="receive" denied_mask="receive"

An unexpected error occoured!

For details, see /tmp/apparmor-bugreport-v3fjxgk8.txt
Please consider reporting a bug at https://bugs.launchpad.net/apparmor/
and attach this file.

Revision history for this message
root (t-root-4) wrote :
Revision history for this message
Seth Arnold (seth-arnold) wrote :

Thanks root,

This error was caused by the log line:
May 27 12:51:51 tty0 kernel: [1896557.253647] audit: type=1400 audit(1464317511.752:362): apparmor="ALLOWED" operation="file_perm" profile="/usr/sbin/nginx" pid=13215 comm="nginx" laddr=45.32.188.150 lport=443 faddr=101.174.56.194 fport=62972 family="inet" sock_type="stream" protocol=6 requested_mask="receive" denied_mask="receive"

root (t-root-4)
information type: Public → Private Security
information type: Private Security → Private
description: updated
information type: Private → Public
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in apparmor (Ubuntu):
status: New → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.