I've been writing some AppArmor profiles and with each new profile I encounter more advanced rules that I haven't seen before.
In this case I'm creating profile for PulseAudio. I also had a profile for SMPlayer, but when I created the PulseAudio profile, AppArmor said something like this to me when I wanted to watch some movie in SMPlayer:
kernel: audit: type=1400 audit(1505370398.880:1005): apparmor="DENIED" operation="capable" profile="/usr/bin/smplayer" pid=40033 comm="pacmd" capability=19 capname="sys_ptrace" Sep 14 08:26:38 morfikownia kernel: audit: type=1400 audit(1505370398.880:1006): apparmor="DENIED" operation="ptrace" profile="/usr/bin/smplayer" pid=40033 comm="pacmd" peer="/usr/bin/pulseaudio"
This can be fixed by adding the following to the SMPlayer profile:
capability sys_ptrace, ptrace (trace) peer=/usr/bin/pulseaudio,
But I have two questions about this:
Why does SMPlayer need the rules now? I have its profile for a while, and SMPlayer never asked for the rules. I know that it's because of creating the profile for PulseAudio, but can anyone explain why?
What do the rules actually mean? What would happen when I didn't add them? SMPlayer seems to work just fine without the CAP and