AppArmor enforce program without logging

[BkkBonanza]

I have a program that generates large amounts of apparmor log messages. I'm happy to enforce restrictions on the program but I really don't want it to fill my log with messages every time it attempts to read a file.

Is there a way to let it enforce restrictions but not log denials?

There should be.

[rookcifer]

I have a program that generates large amounts of apparmor log messages. I'm happy to enforce restrictions on the program but I really don't want it to fill my log with messages every time it attempts to read a file.

Is there a way to let it enforce restrictions but not log denials?

There should be.

If it is logging denials then you have not setup the profile properly. The denials mean the program is not being allowed to do something that it might need to do.

Or, are you saying that the program works fine regardless of these denials? If so, then I can think of two things:

1) Install auditd. It will keep all the apparmor logs in their own separate log file so they wont be filling up /var/log/messages. You can achieve the same result by configuring your rsyslog config file, but it's more complicated.

2)You might be able to explicitly "deny" these operations within your apparmor profile. If you do this, it shouldn't log it every time it denies it.

[Rubi1200]

I know this sounds like a silly question and is probably stating the obvious, but is the profile in complain or enforce mode?

If the former, it is likely to produce a lot of messages depending on what you are trying to restrict.

[BkkBonanza]

It's in enforce mode. The app is actually working fine even though denied access to some things. The app is Skype - which likes to go on rampages reading stuff I don't want it to have access to.

So I've explicitly denied certain things. It still works ok but it fills the log like you wouldn't believe. Basically entries every few seconds 24/7 and they seem to end up in 3 log files so it's a bit overdone really.

I'll look into some rsyslog config to filter them out to another file. I've done that before so it shouldn't be too hard.

Thanks!

[BkkBonanza]

I got this set up and working so I'm going to post what I did here for others.
I just copied the same code as comes default with UFW and modified for apparmor. Now all my apparmor messages go into one log and don't polute the (3) others with junk.

I created a file /etc/rsyslog.d/30-apparmor.conf containing,

# Log kernel generated apparmor log messages to file
:msg,contains,"apparmor" /var/log/apparmor.log

# Uncomment the following to stop logging anything that matches the last rule.
# Doing this will stop logging kernel generated apparmor log messages to the file
# normally containing kern.* messages (eg, /var/log/kern.log)
& ~

That last line can be commented if you want the messages to flow as usual but I wanted it cut down to just the one log file. You have to restart rsyslog but I rebooted anyway since I had other changes pending.

[Dave_L]

Thanks for the information on apparmor logging. I was planning on enabling some apparmor profiles, but didn't want the system logs to be cluttered with apparmor messages.

I have one question. There's a directory /var/log/apparmor/. Is that used for anything on Ubuntu?

----
Edit

I found that /var/log/apparmor/ is listed in the "installed files" for apparmor-utils. Maybe it's used by one or more of the programs in that package.

[BkkBonanza]

I noticed there was a /var/log/apparmor directory created but I've never seen anything in there. I prefer to keep my logs all in /var/log but I can see that when rotating occurs and there are multiple copies it's a bit cluttered. I think either way is good.

[bodhi.zazen]

It is a shame you need to disable logging to quiet apparmor.

IMO it would be nice if apparmor had a few more features and a few tools to help manage alerts.

Perhaps report it as a bug or feature request ?

[BkkBonanza]

Good idea. I added it in launchpad. I couldn't find a place for feature requests so I marked it as feature request and submitted it in bugs section. Maybe some day we'll have the option "per profile logging".

PS. I've already got 4.3MB in the apparmor log in 2 days...

[Dave_L]

In addition to the preceding, if log file rotation is desired, a file /etc/logrotate.d/apparmor with the following contents could be added:

/var/log/apparmor.log {
   rotate 4
   weekly
   compress
   missingok
}

The specific logging options could vary.