question re apparmor

[gene heskett]

Just got a popup that quickly faded, checked dmesg, found this:
[ 61.521774] audit: type=1400 audit(1725204436.106:36):
apparmor="DENIED" operation="unlink" profile="/usr/bin/akonadiserver"
name="/home/gene/.local/share/akonadi/socket-coyote-default" pid=3405
comm="akonadiserver" requested_mask="d" denied_mask="d" fsuid=1000 ouid=0
[ 61.592585] audit: type=1400 audit(1725204436.178:37):
apparmor="DENIED" operation="open" profile="mariadbd_akonadi"
name="/sys/devices/system/node/" pid=3415 comm="mysqld"
requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[ 61.726848] audit: type=1400 audit(1725204436.314:38):
apparmor="DENIED" operation="open" profile="mariadbd_akonadi"
name="/sys/devices/system/node/" pid=3468 comm="mysqld"
requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[ 61.791656] audit: type=1400 audit(1725204436.378:39):
apparmor="DENIED" operation="open" profile="mariadbd_akonadi"
name="/sys/block/" pid=3468 comm="mysqld" requested_mask="r"
denied_mask="r" fsuid=1000 ouid=0
[ 61.808933] audit: type=1400 audit(1725204436.394:40):
apparmor="DENIED" operation="open" profile="mariadbd_akonadi"
name="/sys/devices/pci0000:00/0000:00:1c.7/0000:07:00.0/ata13/host12/target12:0:0/12:0:0:0/block/sdh/queue/physical_block_size"
pid=3468 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[ 66.987054] logitech-hidpp-device 0003:046D:4094.0008: HID++ 4.5
device connected.
[11564.656666] perf: interrupt took too long (2542 > 2500), lowering
kernel.perf_event_max_sample_rate to 78500
[14900.611280] perf: interrupt took too long (3189 > 3177), lowering
kernel.perf_event_max_sample_rate to 62500
[29560.576007] perf: interrupt took too long (4011 > 3986), lowering
kernel.perf_event_max_sample_rate to 49750
[45232.084682] audit: type=1400 audit(1725249606.321:41):
apparmor="DENIED" operation="capable" profile="/usr/sbin/cupsd"
pid=35720 comm="cupsd" capability=12 capname="net_admin"
[72817.527464] Process accounting resumed
[112391.466084] perf: interrupt took too long (5054 > 5013), lowering
kernel.perf_event_max_sample_rate to 39500
[131632.743631] audit: type=1400 audit(1725336006.281:42):
apparmor="DENIED" operation="capable" profile="/usr/sbin/cupsd"
pid=147785 comm="cupsd" capability=12 capname="net_admin"

Config error? real problem? IDK. Machine had huge security update of 115
files + kernel yesterday morning.

Thanks.

Cheers, Gene Heskett, CET.

[Andrew M.A. Cater]

<auditd snipped>

Post by gene heskett
operation="unlink" profile="/usr/bin/akonadiserver"
[ 66.987054] logitech-hidpp-device 0003:046D:4094.0008: HID++ 4.5 device
connected.
kernel.perf_event_max_sample_rate to 49750
[72817.527464] Process accounting resumed
[112391.466084] perf: interrupt took too long (5054 > 5013), lowering
kernel.perf_event_max_sample_rate to 39500

Keyboard / mouse being added - don't know what the perf error is, but
if you're monitoring every interrupt and process, that's an overhead
you maybe can't afford?

Post by gene heskett
Config error? real problem? IDK. Machine had huge security update of 115
files + kernel yesterday morning.

Hi Gene,

If this is a Debian system: you're aware there was a Debian point release
over the weekend?

It looks like you've got four things:

Akonadi server and akonadi crawling the system - that's KDE or maybe LXQT?

mariadb_akonadi

One mention of mysqld - do you have both MariaDB and MySQL running
concurrently?

cupsd

That's all been picked up by apparmor. If you're not sure what audit is
giving you, maybe turn it off?

If you do post a wall of text, please cut it down on replies otherwise
we all get swamped.

All best, as evef,

Andrew Cater

Post by gene heskett
Thanks.
Cheers, Gene Heskett, CET.
--
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author, 1940)
If we desire respect for the law, we must first make the law respectable.
- Louis D. Brandeis