Apparmor question: operation="clone"

Sporkman · 09-09-2009, 03:25 PM

Hi All-

I'm working on an apparmor profile for apache2 (on Ubuntu 9.04 server). It's currently in complain mode, and I get the following complaint (among others):

Sep 9 00:23:19 elcamino kernel: [118235.056951] type=1504 audit(1252470199.886:18401): operation="clone" task=22233 pid=22233 profile="null-complain-profile"

How do I set the profile to allow this "clone" operation (I assume this is when it forks..?)?

-Thx

unSpawn · 10-18-2009, 03:16 AM

If I'm not mistaken "clone" would require CAP_SYS_ADMIN ('man capabilities'). But since these messages are being logged, why don't you use 'aa-logprof' to pick up learning or complain mode output from /var/log/audit/audit.log (or /var/log/messages)?