aa-status does not correctly report all unconfined processes that have a profile defined
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
AppArmor |
Triaged
|
Medium
|
Unassigned |
Bug Description
If a profile is defined using profile names and attachment specification then aa-status does not correctly report when a process is unconfined but has a profile defined.
eg. If the chromium-browser is started and then the chromium profile is loaded using the following declaration
profile chromium-browser /usr/lib/
> sudo aa-status
apparmor module is loaded.
40 profiles are loaded.
17 profiles are in enforce mode.
/bin/foobash
/sbin/dhclient3
/usr/bin/evince
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
chromium-
chromium-
23 profiles are in complain mode.
/bin/ping
/sbin/klogd
/sbin/syslog-ng
/sbin/syslogd
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/
/usr/sbin/cupsd
/usr/
/usr/
/usr/sbin/identd
/usr/sbin/mdnsd
/usr/sbin/nmbd
/usr/sbin/nscd
/usr/sbin/smbd
/usr/
chromium-browser
chromium-
4 processes have profiles defined.
0 processes are in enforce mode :
0 processes are in complain mode.
4 processes are unconfined but have a profile defined.
/sbin/dhclient3 (1805)
/usr/
/usr/
/usr/sbin/cupsd (939)
/usr/bin/
tags: | added: aa-tools |
Changed in apparmor: | |
importance: | Undecided → Medium |
status: | New → Triaged |