Results 1 to 1 of 1

Thread: Logging in AppArmor

  1. #1
    Join Date
    Feb 2021
    Beans
    2

    Logging in AppArmor

    Hello,

    While using aa-logprof (AppArmor version 2.13.4), there were few mentions of "audit[ID]:" and "kernel: audit:" for the same capability(dac_override) in journalctl. Could someone please let me know the difference between them? Why 2 lines are getting logged for dac_override alone?
    Last edited by indhujaavs; 1 Week Ago at 02:46 PM.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •