Trying out Apparmor… It’s enabled and running, but has very few profiles (because Arch doesn’t come with a package of profiles unlike most distros). However I can’t generate my own, it claims it can’t find syslog.
Now, I think I have managed to research enough that by default “syslog” is not used in Arch, it logs events to messages.log instead.
…But how do I get apparmor to understand that?
Already looked there. I even tried to install syslog-ng, but all it did was to create a syslog.log that said (simplfied) “syslog-ng has started” and didn’t add anything else for an hour. All the events for apps were still logged in messages.log.
under aa-genprof -h I get a -f option for logfile path.
Checking /etc/apparmor/logprof.conf it refers to three logs, the middle one being syslog. It seems it expects all three to be there and can’t just skip it.
Edit: Nope, that’s not it. But it seems to a problem with naming. It couldn’t find “messages” either until I actuall typed in the full filename, aka “messages.log”
Okay… Got it to work, but for complex programs like a browser it seems almost impossible to generate a profile, I had to give up after about 50 questions, since apparmor popped up a new question about permissions every 0.5 seconds. And unfortunately there seems to be not a single premade profile anywhere for it.