Apparmor profile locations & Found unexpected keyword: 'mr' errors

23 Aug 2006

      Could someone point out the difference between the profiles stored in
/etc/apparmor.d/ vs /etc/apparmor/profiles/extras/? 

The reason I ask is that I sometimes get errors about profiles claiming
unexpected keyword: 'mr'.  For example, here is one from a netstat
profile:

"Loading AppArmor profiles AppArmor parser error
in /etc/apparmor.d/bin.netstat at line 291: 
Found unexpected keyword: 'mr'
Profile /etc/apparmor.d/bin.netstat failed to load"

If the bin.netstat profile is moved to
the /etc/apparmor/profiles/extras/ directory, and apparmor is restarted,
there isn't any error.  

A 2nd example is illustrated with the usr.lib.postfix.pickup profile.
If the profile in in /etc/apparmor.d, I get this error:

"# rcpostfix restart
Shutting down mail service (Postfix)     done
Starting mail service (Postfix)          failed"

with the following output from /var/log/audit/audit.log:

"type=APPARMOR msg=audit(1156337692.653:44): REJECTING mr access
to /lib/ld-2.4.so (pickup(21068) profile /usr/lib/postfix/pickup
active /usr/lib/postfix/pickup)"

moving usr.lib.postfix.pickup to /etc/apparmor/profiles/extras/ followed
by a restart of apparmor and postfix generates no errors with a postfix
restart. 

Does moving the profile to the extras folder alter its use within
apparmor or render it useless?  

I notice that when I create a new profile it seems to get placed
in /etc/apparmor.d/ but often apparmor won't restart because of the
"Found unexpected keyword: 'mr'" issue or the application won't run
properly due to the "REJECTING mr access" errors. Editing the profile
manually sometimes works but if I later run the update profile wizard it
just places the "m" back in and the application stops working due to
denied access.

I added the contents of the bin.netstat profile at the bottom message
for illustration purposes, but it happens with others and always seems
to involve the letter 'm'.  If there is no fuctional difference between
the two directories, why does one give the error and the other doesn't? 

On a related note, is there a way to include the
contents /var/log/audit/audit.log in the /var/log/allmessages log?

There is no line 291 in the bin.netstat file. but the bin.netstat
profile contents start below: 

#include 

/bin/netstat flags=(complain) {
  #include 
  #include 
  #include 

  capability dac_override,
  capability dac_read_search,

  /bin/netstat rix,
  /etc/ld.so.cache mr,
  /etc/networks r,
  /lib/ld-2.4.so rlix,
  /lib/lib*so* mr,
  /proc r,
  /proc/[0-9]*/cmdline r,
  /proc/[0-9]*/fd r,
  /proc/net r,
  /proc/net/* r,
  /usr/lib/gconv/gconv-modules* mr,
  /usr/lib/locale/** mr,

Apparmor profile locations & Found unexpected keyword: 'mr' errors

rmyster