Apparmor has hats like null-12b08
I am running a Ubuntu 12.04.2 server with Apache using mod_apparmor. When I run aa-status
, I see thousands and thousands (seriously, over 100,000) of profiles with names like
/usr/lib/apache2/mpm-prefork/apache2//DEFAULT_URI//null-12b08
Some of them even stack:
/usr/lib/apache2/mpm-prefork/apache2//scoop//null-2dd76//null-2dd77
What are these? Are they actually hats? If so, why are there so many of them, and is that a potential problem?
Solution 1:
These hats are the result of a profile in complain mode. They will accumulate, but you can clear them with a restart. Once the profile is in enforce mode, they will stop being created.