debian/ossec-hids/usr/share/doc/ossec-hids/contrib/ossec-testing/tests/apparmor.ini

   1 [Ignore ALLOWED or STATUS]
   2 log 1 pass = Jun 24 10:35:29 hostname kernel: [49787.970285] audit: type=1400 audit(1403598929.839:88986): apparmor="ALLOWED" operation="getattr" profile="/usr/sbin/dovecot//null-1//null-2//null-4a6" name="/home/admin/mails/new/" pid=19973 comm="imap" requested_mask="r" denied_mask="r" fsuid=1003 ouid=1003
   3
   4 rule = 52001
   5 alert = 0
   6 decoder = iptables
   7
   8 [Apparmor ALLOWED or STATUS]
   9 log 1 pass = Jun 23 20:46:15 hostname kernel: [   11.103248] audit: type=1400 audit(1403549175.177:2): apparmor="STATUS" operation="profile_load" name="/sbin/klogd" pid=2185 comm="apparmor_parser"
  10
  11 rule = 52001
  12 alert = 0
  13 decoder = iptables
  14
  15 [Apparmor DENIED]
  16 log 1 pass = Jul 14 11:03:47 hostname kernel: [ 8665.951930] type=1400 audit(1405328627.702:54): apparmor="DENIED" operation="open" profile="/usr/bin/evince" name="/etc/xfce4/defaults.list" pid=16418 comm="evince" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
  17
  18 rule = 52002
  19 alert = 3
  20 decoder = iptables
  21
  22 [Apparmor DENIED mknod operation.]
  23 log 1 pass = Jun 16 17:37:39 hostname kernel: [891880.587989] audit: type=1400 audit(1314853822.672:33649): apparmor="DENIED" operation="mknod" parent=27250 profile="/usr/lib/apache2/mpm-prefork/apache2//example.com" name="/usr/share/wordpress/1114140474e5f13bea68a4.tmp" pid=27289 comm="apache2" requested_mask="c" denied_mask="c" fsuid=33 ouid=33
  24
  25 rule = 52004
  26 alert = 4
  27 decoder = iptables
  28
  29 [Apparmor DENIED exec operation.]
  30 log 1 pass = Jun 16 17:37:39 hostname kernel: [891880.587989] audit: type =1400 audit(1315353795.331:33657): apparmor="DENIED" operation="exec" parent=14952 profile="/usr/lib/apache2/mpm-prefork/apache2//example.com" name="/usr/lib/sm.bin/sendmail" pid=14953 comm="sh" requested_mask="x" denied_mask="x" fsuid=33 ouid=0
  31
  32 rule = 52003
  33 alert = 5
  34 decoder = iptables
  35