aa-logprof: Log contains unknown mode senw

Saucy patch 0063-utils-ignore-unsupported-rules.patch was written to ignore policy rules unknown to AppArmor.pm. What's missing is the corresponding patch to ignore unknown denials.

This isn't specific to dbus rules. See the patch mentioned above for the policy rule types that are unsupported by AppArmor.pm.

After using sed to remove all lines containing "send" from /var/log/syslog, the error changed to "Log contains unknown mode reweive."

Additionally, after removing all lines containing "recieve" from /var/log/syslog, the command ran without printing errors.

This bug was fixed in the package apparmor - 2.8.0-0ubuntu34

---------------
apparmor (2.8.0-0ubuntu34) trusty; urgency=low

  [ Tyler Hicks ]
  * 0078-parser-check-for-dbus-kernel-support.patch: The parser should not
    include D-Bus rules in the binary policy that it loads into the kernel if
    the kernel does not support D-Bus rules (LP: #1231778)
  * 0079-utils-ignore-unsupported-log-events.patch: aa-logprof should ignore
    audit events that it does not yet support instead of treating them as
    errors (LP: #1243932)
  * 0080-tests-use-ldconfig-for-library-detection.patch: Fix libapparmor
    detection in regression tests after the multiarch changes

  [ Jamie Strandboge ]
  * 0081-python-abstraction-updates.patch: Add rules in support of Python 3.3

  [ Chad Miller ]
  * debian/patches/0001-add-chromium-browser.patch: Follow new chromium-browser
    sandbox name. Keep old name for now to allow transition. LP: #1247269
 -- Tyler Hicks <email address hidden> Mon, 04 Nov 2013 15:57:30 -0800

Hello Julian, or anyone else affected,

Accepted apparmor into saucy-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/apparmor/2.8.0-0ubuntu31.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

I've verified that the 3 tests added to QRT's test-apparmor.py succeed using the 2.8.0-0ubuntu31.1 package from -proposed.

The verification of the Stable Release Update for apparmor has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Two questions:
- was the fix commited to the 2.8 branch?
- does this bug also exist in the python utils?

Apparmor 2.9.0 has been released; closing.

I have the 2.9 package but this bug still seems to affect me:

ii apparmor-utils 2.9.2~2880-0ubun amd64 Utilities for controlling AppArmor

# aa-logprof
Reading log entries from /var/log/syslog.
Updating AppArmor profiles in /etc/apparmor.d.
Traceback (most recent call last):
  File "/usr/sbin/aa-logprof", line 54, in <module>
    apparmor.do_logprof_pass(logmark)
  File "/usr/lib/python2.7/dist-packages/apparmor/aa.py", line 2279, in do_logprof_pass
    log = log_reader.read_log(logmark)
  File "/usr/lib/python2.7/dist-packages/apparmor/logparser.py", line 349, in read_log
    event = self.parse_log_record(line)
  File "/usr/lib/python2.7/dist-packages/apparmor/logparser.py", line 88, in parse_log_record
    record_event = self.parse_event(record)
  File "/usr/lib/python2.7/dist-packages/apparmor/logparser.py", line 128, in parse_event
    raise AppArmorException(_('Log contains unknown mode %s') % rmask)
apparmor.common.AppArmorException: 'Log contains unknown mode senw'

See also bug 1426651 (for 'trace', but the fix will cover both)

BTW: After checking the bzr log, I'm slightly surprised why this bug was closed as fixed - there's no commit (in trunk or 2.9) logparser.py that relates to this bug :-/

Patch sent to the mailinglist for review. However, I'm afraid you can't "just apply it" for testing because it is based on a whole patch series that is not in bzr yet.

The fix I implemented in my system was to add the following check to /usr/lib/python2.7/dist-packages/apparmor/logparser.py, in lines 124:

if rmask and rmask not in [ 'send', 'receive', 'send receive' ]:

Originally it was:

if rmask:

The same in line 130 for dmask. This file comes from python-apparmor package 2.9.2~2886-0ubuntu0.14.04.41 installed from the PPA.

Fix commited to bzr trunk and 2.9 branch.

I hit this bug after installing auditd to work around bug Bug #1399027. Only in addition to the changes above I had to use:

line 123:
if rmask and rmask not in [ 'send', 'receive', 'send receive', 'send receive connect','create' ]:

line 129:
if dmask and dmask not in [ 'send connect', ]:

Hopefully a better fix is in the newer branch and will be released to Ubuntu 15.04 in a timely manner.

agent 8131, apparmor 2.9.2-0ubuntu1 just landed in wily and contains a fix for this that attempts to only apply the transformation for file based events, specifically in http://bazaar.launchpad.net/~apparmor-dev/apparmor/2.9/revision/2905 , so you should no longer see this in wily.

Also, this version (2.9.2) of the python tools has been backported to trusty for an SRU. Please leave feedback on bug 1449769 if you are using trusty as to whether the proposed packages improves the usability of the tools in that release and if you discover significant regressions from it.

Both 2.9.2 and the trusty SRU should also address the issue in Bug #1399027. Again, feedback in that bug on the trusty SRU would be greatly appreciated.

Thanks for your patience!

It would be nice if patches that are backported to trusty are also backported to 15.04. I upgraded to 15.04 to enjoy newer features.
I was expecting to only see new bugs related to those newer features that I chose to upgrade to, not expecting patches that made it to 14.04 didn't make it to 15.04.
Like this one and Bug #1399027.

Since 15.10 is expected near the end of the month I am not really expecting this to get into 15.04 now.
In the future it would be nice if SRU meant fixing both the LTS and the current stable Ubuntu release.