apparmor log message containing long string of characters

English Applications
#1

In the logs I see concerning my apparmor profile for firefox:

apparmor=“DENIED” operation=“open” parent=5592 profile="/usr/lib64/firefox/firefox{" name=2F6D6E742F6D79696E7465726E65742F6D797468756E646572626972642D64617669642F2E7468756E646572626972642F4372617368205265706F7274732F496E7374616C6C54696D6532303133313230373030 pid=5593 comm=“thunderbird-bin” requested_mask=“r” denied_mask=“r” fsuid=1000 ouid=1000

This doesn’t give me a hind as to what file was access denied by firefox since it is only a long string of characters. Anyone has a clue to what this refers?

#2

I converted the hex string

2F6D6E742F6D79696E7465726E65742F6D797468756E646572626972642D64617669642F2E7468756E646572626972642F4372617368205265706F7274732F496E7374616C6C54696D6532303133313230373030

iinto characters:

/mnt/myinternet/mythunderbird-david/.thunderbird/Crash Reports/InstallTime2013120700

Does that help?

#3

wow, thanks, that really helps!

What is the easiest way to do such conversion? I have lots of experience with shell scripts, but hex code just never crossed my path up till now.

#4

I search with G on the internet and found:

henk@boven:~> echo '2F6D6E742F6D79696E7465726E65742F6D797468756E646572626972642D64617669642F2E7468756E646572626972642F4372617368205265706F7274732F496E7374616C6C54696D6532303133313230373030' | perl -ne 's/([0-9a-f]{2})/print chr hex $1/gie'
/mnt/myinternet/mythunderbird-david/.thunderbird/Crash Reports/InstallTime2013120700henk@boven:~>

(remark that there is no new line at the end)).

#5

On 2014-01-28 13:36, hcvv wrote:
>
> dutchkind;2620042 Wrote:
>>
>> What is the easiest way to do such conversion? I have lots of experience
>> with shell scripts, but hex code just never crossed my path up till now.
> I search with G on the internet and found:
>
> Code:
> --------------------
> henk@boven:~> echo ‘2F6D6E742F6D79696E7465726E65742F6D797468756E646572626972642D64617669642F2E7468756E646572626972642F4372617368205265706F7274732F496E7374616C6C54696D6532303133313230373030’ | perl -ne ‘s/([0-9a-f]{2})/print chr hex $1/gie’
> /mnt/myinternet/mythunderbird-david/.thunderbird/Crash Reports/InstallTime2013120700henk@boven:~>
> --------------------
>
> (remark that there is no new line at the end)).

Very curious.

There must be a switch in AA to log in plain text or with that encoding.
Maybe they do it that way because it is faster :-?

–
Cheers / Saludos,

Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)