* Daniel Morris <danielm@ecoscentric.com> [05-17-21 08:15]:
On Sat, May 15, 2021 at 08:24:29PM +0200, Jogchum Reitsma wrote:
Hmm, up till an hour ago my only knowledge of apparmor was how it is pronounced, so I did some googling.
There is a file /etc/apparmor.d/ghostscript on my system.
aa-status mentions ghostscript is in enforce mode.
And /var/log/audit/audit.log contains the message
type=AVC msg=audit(1621101856.180:23935): apparmor="DENIED" operation="file_mmap" profile="ghostscript" name="/usr/local/lib64/libpcre2-8.so.0.8.0" pid=28013 comm="gs" requested_mask="m" denied_mask="m" fsuid=0 ouid=0
Wouldn't it be nice/conventional to have a time-stamp to match the errant activity against?
but you do have, just not converted to the format you desire. 1621101856.180 https://www.epochconverter.com/ -- (paka)Patrick Shanahan Plainfield, Indiana, USA @ptilopteri http://en.opensuse.org openSUSE Community Member facebook/ptilopteri Photos: http://wahoo.no-ip.org/piwigo paka @ IRCnet freenode