aa-logprof doesn't support unix rules/events

That's no a bug, it's a missing feature ;-) - aa-logprof doesn't have support for unix rules/events yet, so you'll need to allow this by manually adding rules.

Nevertheless, thanks for the log - having some example log lines is always helpful.

Dec 21 09:49:19 th1nkp4d kernel: [ 1807.331151] audit: type=1400 audit(1450687759.549:3582): apparmor="ALLOWED" operation="connect" profile="/usr/sbin/cupsd" pid=6049 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send connect" addr=none peer_addr="@2F746D702F65736574732E736F636B0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" peer="unconfined"

BTW: peer_addr decodes to

# aa-decode 2F746D702F65736574732E736F636B
Decoded: /tmp/esets.sock

(I wonder if the tons of 0000000 are intentional - John, can you clarify this, please?)

Yup, aa-logprof doesn't recognize unix rules and events. If I add manually this rules, after next aa-logprof running and answering questions, all added unix rules are deleted from profile files.

Loosing unix rules is already fixed in bzr (trunk r3310, 2.10 branch r3292, 2.9 branch r2981) since a week, see bug 1522938.

BTW: Given how many issues you find, maybe you should switch to bzr trunk? ;-)

I will :)

The zeros are probably intentional; the name of abstract unix sockets allows ascii NULs, and they may or may not be relevant based on the address length as reported in the C APIs. It's a terrible interface all around.. (and now that I just now realize that a unix socket with name @00...00 len=2 is different from unix socket with name @00...00 len=4 I wonder what breaks if these two are actually used somewhere. Hmm.)

Well, maybe things are even more interesting:
- the log message doesn't specify the len, so a socket name ending with \0 _will_ cause trouble
- for some reason, the log line above gets parsed as AA_RECORD_INVALID:

START
File: testcase_syslog_unix_01.in
Event type: AA_RECORD_INVALID
Audit ID: 1450687759.549:3582
Operation: connect
Mask: send receive connect
Denied Mask: send connect
Profile: /usr/sbin/cupsd
Command: cupsd
PID: 6049
Network family: unix
Socket type: stream
Protocol: ip
Epoch: 1450687759
Audit subid: 3582

- the peer address isn't included in the parsed log - but that might be a side effect and/or reason for AA_RECORD_INVALID