On 2013-12-08 11:12, Per Jessen wrote:
G systemd: pam_apparmor(systemd-user:session): Unknown error occurred changing to root hat: Operation not permitted G kernel: [13216.734228] type=1400 audit(1386239402.861:35): apparmor="DENIED" operation="change_hat" info="unconfined" error=-1 pid=12737 com
The log message can't be much more clear than that. apparmor is denying rkhunter the use of "change_hat".
No, that message is typically irrelevant. It is a packaging bug, IMHO, a certain component of AA is enabled by default, but there is no default configuration for it. See Bug 807130, Bug 807106, Bug 807103. «The easiest fix is to uninstall the pam_apparmor package.» It is irrelevant because it should not block anything, just pollutes the logs. -- Cheers / Saludos, Carlos E. R. (from 12.3 x86_64 "Dartmouth" at Telcontar)