[apparmor] program with a space in the name results in hashes where names should be

[John Johansen]

On 07/28/2016 06:19 AM, Mark Wadham wrote:
> I tried to write an apparmor profile for plex media server, which has a binary with spaces in the name.
> 
> I put it in quotes in the apparmor profile, but then all the complain messages have hashes where the name should be, eg:
> 
>> [ 9551.412776] audit: type=1400 audit(1469711661.099:16933): apparmor="ALLOWED" operation="recvmsg" profile=2F7573722F6C69622F706C65786D656469617365727665722F506C6578204D65646961205365727665722F2F6E756C6C2D2F7573722F6C69622F706C65786D656469617365727665722F506C657820444C4E4120536572766572 pid=25858 comm=506C657820444C4E41205365727665 lport=1900 family="inet" sock_type="dgram" protocol=17 requested_mask="receive" denied_mask="receive"
>> [ 9551.418972] audit: type=1400 audit(1469711661.107:16934): apparmor="ALLOWED" operation="create" profile=2F7573722F6C69622F706C65786D656469617365727665722F506C6578204D65646961205365727665722F2F6E756C6C2D2F7573722F6C69622F706C65786D656469617365727665722F506C657820444C4E4120536572766572 pid=25983 comm=506C657820444C4E41205365727665 family="inet" sock_type="dgram" protocol=0 requested_mask="create" denied_mask="create"
>> [ 9551.419247] audit: type=1400 audit(1469711661.107:16935): apparmor="ALLOWED" operation="create" profile=2F7573722F6C69622F706C65786D656469617365727665722F506C6578204D65646961205365727665722F2F6E756C6C2D2F7573722F6C69622F706C65786D656469617365727665722F506C657820444C4E4120536572766572 pid=25983 comm=506C657820444C4E41205365727665 family="inet" sock_type="dgram" protocol=0 requested_mask="create" denied_mask="create"
>> [ 9551.419610] audit: type=1400 audit(1469711661.107:16936): apparmor="ALLOWED" operation="create" profile=2F7573722F6C69622F706C65786D656469617365727665722F506C6578204D65646961205365727665722F2F6E756C6C2D2F7573722F6C69622F706C65786D656469617365727665722F506C657820444C4E4120536572766572 pid=25983 comm=506C657820444C4E41205365727665 family="unix" sock_type="dgram" protocol=0 requested_mask="create" denied_mask="create" addr=none
>> [ 9551.419712] audit: type=1400 audit(1469711661.107:16937): apparmor="ALLOWED" operation="create" profile=2F7573722F6C69622F706C65786D656469617365727665722F506C6578204D65646961205365727665722F2F6E756C6C2D2F7573722F6C69622F706C65786D656469617365727665722F506C657820444C4E4120536572766572 pid=25983 comm=506C657820444C4E41205365727665 family="unix" sock_type="dgram" protocol=0 requested_mask="create" denied_mask="create" addr=none
>> [ 9551.419846] audit: type=1400 audit(1469711661.107:16938): apparmor="ALLOWED" operation="getsockname" profile=2F7573722F6C69622F706C65786D656469617365727665722F506C6578204D65646961205365727665722F2F6E756C6C2D2F7573722F6C69622F706C65786D656469617365727665722F506C657820444C4E4120536572766572 pid=25983 comm=506C657820444C4E41205365727665 family="inet" sock_type="dgram" protocol=17 requested_mask="getattr" denied_mask="getattr"
>> [ 9551.419940] audit: type=1400 audit(1469711661.107:16939): apparmor="ALLOWED" operation="getpeername" profile=2F7573722F6C69622F706C65786D656469617365727665722F506C6578204D65646961205365727665722F2F6E756C6C2D2F7573722F6C69622F706C65786D656469617365727665722F506C657820444C4E4120536572766572 pid=25983 comm=506C657820444C4E41205365727665 family="inet" sock_type="dgram" protocol=17 requested_mask="getattr" denied_mask="getattr"
>> [ 9551.420017] audit: type=1400 audit(1469711661.107:16940): apparmor="ALLOWED" operation="setsockopt" profile=2F7573722F6C69622F706C65786D656469617365727665722F506C6578204D65646961205365727665722F2F6E756C6C2D2F7573722F6C69622F706C65786D656469617365727665722F506C657820444C4E4120536572766572 pid=25983 comm=506C657820444C4E41205365727665 family="inet" sock_type="dgram" protocol=17 requested_mask="setopt" denied_mask="setopt"
>> [ 9551.420106] audit: type=1400 audit(1469711661.107:16941): apparmor="ALLOWED" operation="connect" profile=2F7573722F6C69622F706C65786D656469617365727665722F506C6578204D65646961205365727665722F2F6E756C6C2D2F7573722F6C69622F706C65786D656469617365727665722F506C657820444C4E4120536572766572 pid=25983 comm=506C657820444C4E41205365727665 family="inet" sock_type="dgram" protocol=17 requested_mask="connect" denied_mask="connect"
>> [ 9551.420196] audit: type=1400 audit(1469711661.107:16942): apparmor="ALLOWED" operation="getsockname" profile=2F7573722F6C69622F706C65786D656469617365727665722F506C6578204D65646961205365727665722F2F6E756C6C2D2F7573722F6C69622F706C65786D656469617365727665722F506C657820444C4E4120536572766572 pid=25983 comm=506C657820444C4E41205365727665 laddr=45.32.182.252 lport=38561 faddr=45.32.182.252 fport=42674 family="inet" sock_type="dgram" protocol=17 requested_mask="getattr" denied_mask="getattr"
> 
> Am I doing something wrong or is this just not very well supported yet?
> 
Its fine, the kernel audit subsystem is doing a hex encoding on the string to try and keep it from breaking userspace log parsing. It does this for a whole bunch of different characters that it considers to be not safe

logprof should be able to decode these, we also have a command line utility to do it

aa-decode 2F7573722F6C69622F706C65786D656469617365727665722F506C6578204D65646961205365727665722F2F6E756C6C2D2F7573722F6C69622F706C65786D656469617365727665722F506C657820444C4E4120536572766572
Decoded: /usr/lib/plexmediaserver/Plex Media Server//null-/usr/lib/plexmediaserver/Plex DLNA Server