[prev in list] [next in list] [prev in thread] [next in thread] 

List:       opensuse-security
Subject:    Re: [opensuse-security] apparmor DENIED despite rule
From:       Christian Boltz <suse-security () cboltz ! de>
Date:       2014-08-20 16:53:53
Message-ID: 3293878.2fhbTvFtzj () tux ! boltz ! de ! vu
[Download RAW message or body]

Hello,

Am Mittwoch, 20. August 2014 schrieb pinguin74:
> > > What is this numeric monster 2F686F6D652F6D616C74655F67656C6C2.....
> > > vlc wants to access?
> > 
> > It is ascii encoded string with special characters. (where special
> > can be SPACE or ")
> > 
> > 2F = /
> > 68 = h
> > 6F = o
> > ...
> > 
> > There seems to be as space (20) inside a path you access.
> 
> That īs odd, do I need now to first decode all these numeric
> strings....

If you are bored, you can decode it manually.

Otherwise, just run
    aa-decode 2F686F6D652F6D616C74655F67656C6C2F2E69636F6E732F4772696666696E20456D6265727320437572736F72732F637572736F72732F6C6566745F707472
 ;-)

You can also pipe the logfile through aa-decode, and it will decode 
everything on the fly:

    tail -f /var/log/audit/audit.log | aa-decode


Regards,

Christian Boltz
-- 
> It's several weeks since I last got bitten by this. Maybe this is only
> luck, or maybe this is caused by some application which I am using and
> which got fixed meanwhile.
Ah ah, of course I only had to write that for it to happen again to me
today! [Jean Delvare in https://bugzilla.novell.com/782909#c6 and #c7]

--
To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org
To contact the owner, e-mail: opensuse-security+owner@opensuse.org


[prev in list] [next in list] [prev in thread] [next in thread]