Apparmor denied event - /var/log/syslog - apache2

[sighmon]

Bug

Description

Since the 14/10/2017 I've seen a bunch of Alert Level 7 OSSEC warnings.

Steps to Reproduce

Standard SecureDrop install. Possibly after an unattended upgrade.

Expected Behavior

No alerts.

Actual Behavior

13 alerts similar to the one below.

OSSEC HIDS Notification.
2017 Oct 14

Received From: (app) x.x.x.x->/var/log/syslog
Rule: 100012 fired (level 7) -> "Apparmor denied event"
Portion of the log(s):

Oct 15 app kernel: [  xxx ] audit: type=1400 audit(xxx): apparmor="DENIED" operation="open" profile="/usr/sbin/apache2" name="/proc/xxx/status" pid=xxx comm="apache2" requested_mask="r" denied_mask="r" fsuid=xx ouid=0

 --END OF NOTIFICATION

Comments

Not sure if this is something to be worried about or a bug.

[b-meson]

@sighmon This looks like an change to the Apache binary which means we may need to create new App Armor profiles. I was able to reproduce this issue on a local install of Secure Drop, which seems like a Secure Drop wide issue that we need to fix. Thanks for reporting this!