Hello, Am Dienstag, 15. November 2022, 19:26:57 CET schrieb Joe Salmeri: [...]
Note that there is no /var/cache/apparmor/201d1af9.0/usr.sbin.smbd - my autogenerated profile sniplet is too old: [...] Here are the results from my system [...] -rw------- 1 root root 45K Nov 3 22:41 /var/cache/apparmor/201d1af9.0/usr.sbin.smbd
Just for explanation: That was created after you gave your smb.conf a new timestamp, which triggered an update of the profile sniplet.
Thanks for the info on aa-decode.
I also found ausearch -i will convert the audit timestamps to human readable.
Nice, I wasn't aware of that ;-) If you only want to convert a single timestamp, you can use date -d @1668549191
Does that mean you also don't get denials for /var/lib/nscd/netgroup ? If not, maybe it was related to the strange things you've seen, and we don't need to allow it?
No, it still has DENIED for /var/lib/nscd/netgroup.
None for today 11/15/2022 but here are the ones for the last 3 days
type=AVC msg=audit(11/12/22 14:40:33.855:2363) : apparmor=DENIED operation=file_receive profile=smbd name=/var/lib/nscd/netgroup pid=5876 comm=smbd requested_mask=r denied_mask=r fsuid=root ouid=root
Submitted upstream: https://gitlab.com/apparmor/apparmor/-/merge_requests/948 Regards, Christian Boltz -- liegt es vielleicht an den lauschigen 34°, die der Prozessor oder sowas nicht mitmacht? -> Soll ich mit dem Rechner jetzt zum Baggersee rausfah- ren und ihm ne Abkühlung verpassen... [Sebastian Schulze in suse-linux]