Apparmor enforcement messages have begun appearing in the syslog of a Trisquel 7 machine. The affected programs requested
open of the file
/etc/ld.so.preload, in read mode and were denied by apparmor policy. The following is the very first instance of the message:-
May 8 21:25:54 box kernel: [928193.797140] type=1400 audit(1462739154.627:76): \ apparmor="DENIED" operation="open" profile="/usr/lib/NetworkManager/nm-dhcp-client.action" \ name="/etc/ld.so.preload" pid=13471 comm="nm-dhcp-client." requested_mask="r" \ denied_mask="r" fsuid=0 ouid=0
Some other apparmor constrained programs are being denied the same request, including cupsd and mysqld.
The apparmor profiles have not changed and these messages have never appeared before - so it seems that these (and perhaps other, non-constrained) programs have suddenly started trying to read the (empty) file
My only clue is that earlier that day I had compiled mame for the first time. I ran an emulated machine some time before that first message and left it running unattended. The host machine became unresponsive shortly after I returned to it and I had to reset it about 20 minutes after that message.
So could these two things be related and where should I start looking to find out why those programs are now looking for preloading libraries?