Results 1 to 1 of 1

Thread: Logging in AppArmor

  1. #1
    Join Date
    Feb 2021

    Logging in AppArmor


    While using aa-logprof (AppArmor version 2.13.4), there were few mentions of "audit[ID]:" and "kernel: audit:" for the same capability(dac_override) in journalctl. Could someone please let me know the difference between them? Why 2 lines are getting logged for dac_override alone?
    Last edited by indhujaavs; 1 Week Ago at 02:46 PM.


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts