<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div><blockquote type="cite" class="">Hi Walter,<br class=""><div class=""><br class="">Anything new with this? I have a similar hat mismatch, but I've never been<br class="">able to reproduce it. Did you manage to get strace output?<br class=""></div></blockquote><div><br class=""></div><div>Hi Kees,</div><div><br class=""></div><div>I did manage to minimize my case (e.g. use a simple ‘hello world' instead of Wordpress) and still reproduce. I have strace output for a successful run versus a failing run, with the same sequence and timing of of client requests.</div><div><br class=""></div><div>The traces are huge and I didn’t find a good tool to present them (like a sideways diff HTML generator), so I forgot about them. But they are here (I replaced some variables like the pid to lower the number of uninteresting diffs):</div><div><a href="http://lf.ms/apparmor/strace-ok.txt" class="">http://lf.ms/apparmor/strace-ok.txt</a></div><div><a href="http://lf.ms/apparmor/strace-fail.txt" class="">http://lf.ms/apparmor/strace-fail.txt</a></div><div><br class=""></div><div>The Apache install is not completely minimal; there is still some unnecessary ‘noise’ in the traces from ModSecurity. Its delays however make reproduction much easier for me. When I disabled ModSec rules, I could reproduce much less reliably, like 1 in 100 tries, so I never got a good trace in that state.</div><div><br class=""></div><div>PS: I also talked to a developer of an (unrelated) Apache module. He was quite skeptical about using the log_transaction hook in the way that we rely on for changing hats back. I didn’t find more appropriate hooks from a quick look in Apache source, but if this hook turns out to be unreliable, maybe we could try going on the Apache modules dev list and see if a more reliable hook can be added which is guaranteed to fire at a useful time. Since the request lifecycle is also undergoing architectural changes with mod_h2 coming, maybe the module will require a bit of work anyway to be future proof… But as I understood it, this shouldn’t be a whole lot.</div><div><br class=""></div><div>I’ll be happy to invest more time if I can be useful.</div><div><br class=""></div><div>Cheers!</div><div>WH</div><div><br class=""></div></div><div apple-content-edited="true" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: 'Lucida Grande'; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">-- <br class="">Walter Hop | PGP key: <a href="https://lifeforms.nl/pgp" class="">https://lifeforms.nl/pgp</a></div></div> </div> <br class=""></body></html>