Operation="profile_load" name="/usr/bin/timesync" pid=1698 comm="apparmor_parser

AppArmor
#1

this message appeared when i load whonix 9.6,tester repository with both gateway&workstation loading screen (i dont know if its normal or not):-

[ 10.014901] type=1400 audit (1429194800.883:11): apparmor="STATUS" operation="profile_load" name="/usr/bin/timesync" pid=1698 comm="apparmor_parser" failed!

#2

It is not “normal”, The failed message is due to the parsing error in the syslogd profile. But you can leave with it, timesync should still be confined by AppArmor.

To check it, run

to see the list of enforced processes.

The failed message should be gone after running

sudo aa-disable /etc/apparmor.d/sbin.syslogd
and rebooting.

#3

i did that , but another failed message have appeared:-

http://s1.postimg.org/rs4wj0b25/another_appeared.jpg

[ 10.340184] type=1400 audit (1429268933.196:11): apparmor="STATUS" operation="profile_load" name="/usr/bin/whonixcheck" pid=1684 comm="apparmor_parser" failed!

is this message because of the disabling of /etc/apparmor.d/sbin.syslogd ?

also did u have looked for the message that says :-

ERROR processing regexs for profile sanitized_helper, failed to load
#4

It means that one of the Debian profiles has a parsing problem, not the whonixcheck profile.

Again, you can check which profiles are in enforced mode with

Explanation: the Debian profiles are developed in jessie/sid with the latest version of AppArmor (2.9). Whonix being still based on wheezy, we are using AppArmor 2.7, hence the errors reported from some of the Debian profile.

This is not a problem. To get rid of the red “failed!” message, you should disable all the non whonix profiles.

#5

cool , got that. thnx for the explanation

troubadour :-* (i dont know why there is no flower in the symbol but a kiss on the cheek np either) lol