Hello,
While using aa-logprof (AppArmor version 2.13.4), there were few mentions of "audit[ID]:" and "kernel: audit:" for the same capability(dac_override) in journalctl. Could someone please let me know the difference between them? Why 2 lines are getting logged for dac_override alone?
Bookmarks