Apparmor security event notification error.

Greetings everyone, I am currently trying to figure out a problem AFTER figuring out another problem. LOL!
Currently the Apparmor program has the notification logs saved to /etc/apparmor/notify.cfg, however, when I try to save the notification after putting my email address in, I get an error saying “**Configuration failed for the following operations: Unable to write config changes to /etc/apparmor/notify.cfg”**looking inside the folder, I do not see any file named “notify.cfg” BUT I do see so files called reports.conf, logprof.conf, and reports.crontab. I am guessing that the program is asking to save the notification changes to a file that does not exist and in fact one of those three files are the proper ones to use. Well if that is the case then how would I go about fixing this error? Thank you! :slight_smile:

On 2010-11-13 20:06, Stormchoir wrote:
>
> Greetings everyone, I am currently trying to figure out a problem AFTER
> figuring out another problem. LOL!
> Currently the Apparmor program

Which AA program? There are several.

> has the notification logs saved to
> /etc/apparmor/notify.cfg,

Logs are saved, as all logs are, to somewhere under /var/log/, not to
anywhere under /etc/*. In this case, there is “/var/log/audit/” and
“/var/log/apparmor/”.

For configuration files, there are several places:

/etc/apparmor/*
/etc/apparmor.d/*
/etc/audit/*

As to /etc/apparmor/notify.cfg, I have it but empty. And I find no
reference to this file in the documentation - which is not that much of a
surprise, the state of AA in suse is doubtful since they fired the devs in
Oct 07.

For example, the documentation file (techdoc.pdf) has this opening statement:

AppArmor Technical Documentation
Andreas Gruenbacher and Seth Arnold
{agruen,seth.arnold}@suse.de
SUSE Labs / Novell
October 24, 2009

This can not be true, it is no longer maintained by suse labs, but by
Ubuntu - and Seth Arnold is no longer at Suse, AFAIK.

Perhaps we now hoave to search here (the wikipedia article is obsolete):

https://wiki.ubuntu.com/AppArmor
https://help.ubuntu.com/community/AppArmor
https://apparmor.wiki.kernel.org/index.php/Main_Page

A search there for “notify.cfg” doesn’t hit anything.


Cheers / Saludos,

Carlos E. R.
(from 11.2 x86_64 “Emerald” at Telcontar)

Thank you for your response! =D The next question is how would I go about fixing this error? I am thinking about just uninstalling apparmor from opensuse all together and being done with it.

oh another thing I forgot to mention, when I was setting up app armor for the first time and I was putting my email in for the notifications and when I went to save, it gave me the “Configuration failed for the following operations: Unable to write config changes to /etc/apparmor/notify.cfg” errorr message. Also when I go back into apparmor it shows it no check mark in the Enabled box. Wow I am confusing myself lol! Thanks all for your future input.

Problem solved! I uninstalled and re-installed apparmor and the problem went away! :slight_smile: