在AppArmor中，正常情况下，一旦违反了规则，是能够在内核及系统日志中看到相关信息的。比如：在Ubuntu下正常产生的日志信息（示例）如下：
kernel: [140321.028000] audit(1191433716.584:1578): type=1502 operation=”inode_create” requested_mask=”w” denied_mask=”w” name=”/home/n1/Desktop/abc” pid=4864 profile=”/home/n1/Desktop/testapp”
kernel: [140362.236000] audit(1191433758.086:1579): type=1502 operation=”inode_permission” requested_mask=”r” denied_mask=”r” name=”/home/n1/Desktop/abcd” pid=4877 profile=”/home/n1/Desktop/testapp”根据以上日志信息，定位到产生此日志的内核代码是security/apparmor/audit.c中的audit_pre函数。audit_pre函数在<linux内核源码根目录>/security/apparmor/audit.c中，代码如下：
/**
* audit_base - core AppArmor function.
* @ab: audit buffer to fill (NOT NULL)
* @ca: audit structure containing data to audit (NOT NULL)
*
* Record common AppArmor audit data from @sa
*/
static void audit_pre(struct audit_buffer *ab, void *ca)
{
struct common_audit_data *sa = ca;
if (aa_g_audit_header) {
audit_log_format(ab, "apparmor=\"%s\"",
aa_audit_type[aad(sa)->type]);
}
if (aad(sa)->op) {
audit_log_format(ab, " operation=\"%s\"", aad(sa)->op);
}
if (aad(sa)->info) {
audit_log_format(ab, " info=\"%s\"", aad(sa)->info);
if (aad(sa)->error)
audit_log_format(ab, " error=%d", aad(sa)->error);
}
if (aad(sa)->label) {
struct aa_label *label = aad(sa)->label;
if (label_isprofile(label)) {
struct aa_profile *profile = labels_profile(label);
if (profile->ns != root_ns) {
audit_log_format(ab, " namespace=");
audit_log_untrustedstring(ab,
profile->ns->base.hname);
}
audit_log_format(ab, " profile=");
audit_log_untrustedstring(ab, profile->base.hname);
} else {
audit_log_format(ab, " label=");
aa_label_xaudit(ab, root_ns, label, FLAG_VIEW_SUBNS,
GFP_ATOMIC);
}
}
if (aad(sa)->name) {
audit_log_format(ab, " name=");
audit_log_untrustedstring(ab, aad(sa)->name);
}
}
而audit_pre函数是在同文件中的aa_audit_msg函数中被调用的，该函数代码如下：
/**
* aa_audit_msg - Log a message to the audit subsystem
* @sa: audit event structure (NOT NULL)
* @cb: optional callback fn for type specific fields (MAYBE NULL)
*/
void aa_audit_msg(int type, struct common_audit_data *sa,
void (*cb) (struct audit_buffer *, void *))
{
aad(sa)->type = type;
common_lsm_audit(sa, audit_pre, cb);
}common_lsm_audit函数在security/lsm_audit.c中实现，代码如下：
/**
* common_lsm_audit - generic LSM auditing function
* @a: auxiliary audit data
* @pre_audit: lsm-specific pre-audit callback
* @post_audit: lsm-specific post-audit callback
*
* setup the audit buffer for common security information
* uses callback to print LSM specific information
*/
void common_lsm_audit(struct common_audit_data *a,
void (*pre_audit)(struct audit_buffer *, void *),
void (*post_audit)(struct audit_buffer *, void *))
{
struct audit_buffer *ab;
if (a == NULL)
return;
/* we use GFP_ATOMIC so we won't sleep */
ab = audit_log_start(audit_context(), GFP_ATOMIC | __GFP_NOWARN,
AUDIT_AVC);
if (ab == NULL)
return;
if (pre_audit)
pre_audit(ab, a);
dump_common_audit_data(ab, a);
if (post_audit)
post_audit(ab, a);
audit_log_end(ab);
}
在此函数开头处加入打印语句，如：printk(KERN_ERR "daozhelilema? phph?");，观察/var/log/kern.log或/var/log/syslog文件，看是否出现此打印信息。
重新编译内核并烧录及重启后，重新通过sudo aa-genprof test_app生成规则文件。然后再次执行./test_app abc，同时通过tail -f /var/log/kern.log看是否有打印。
/var/log/kern.log中最终出现以下打印：
Apr 27 14:45:55 Ding-Perlis-MP260S48 kernel: [ 645.816085] daozhelilema? phph?说明能够到common_lsm_audit函数。
在此函数中继续添加更多打印，观察是否能够进入common_lsm_audit函数中的pre_audit即实际的audit_pre函数。加入更多打印后的comon_lsm_audit函数代码如下：
void common_lsm_audit(struct common_audit_data *a,
void (*pre_audit)(struct audit_buffer *, void *),
void (*post_audit)(struct audit_buffer *, void *))
{
struct audit_buffer *ab;
printk(KERN_ERR "daozhelilema? phph?");
if (a == NULL)
return;
/* we use GFP_ATOMIC so we won't sleep */
ab = audit_log_start(audit_context(), GFP_ATOMIC | __GFP_NOWARN,
AUDIT_AVC);
printk(KERN_ERR "daozhelilema2? phph?");
if (ab == NULL)
return;
printk(KERN_ERR "daozhelilema3? phph?");
if (pre_audit)
{
printk(KERN_ERR "daozhelilema4? phph?");
pre_audit(ab, a);
}
dump_common_audit_data(ab, a);
if (post_audit)
post_audit(ab, a);
audit_log_end(ab);
}重复前述步骤，最终看到/var/log/kern.log出现如下打印：
Apr 27 15:01:43 Ding-Perlis-MP260S48 kernel: [ 179.266281] daozhelilema? phph?
Apr 27 15:01:43 Ding-Perlis-MP260S48 kernel: [ 179.266288] daozhelilema2? phph?
Apr 27 15:01:43 Ding-Perlis-MP260S48 kernel: [ 179.266290] daozhelilema3? phph?
Apr 27 15:01:43 Ding-Perlis-MP260S48 kernel: [ 179.26630] daozhelilema4? phph?再次深入跟进，这一次连同security/apparmor/audit.c中的audit_pre函数一起加上打印，代码如下所示：
static void audit_pre(struct audit_buffer *ab, void *ca)
{
struct common_audit_data *sa = ca;
printk(KERN_ERR "daozhelilema11? phph?\n");
if (aa_g_audit_header) {
printk(KERN_ERR "daozhelilema22? phph?\n");
audit_log_format(ab, "apparmor=\"%s\"",
aa_audit_type[aad(sa)->type]);
}
printk(KERN_ERR "daozhelilema33? phph?\n");
if (aad(sa)->op) {
printk(KERN_ERR "daozhelilema44? phph?\n");
audit_log_format(ab, " operation=\"%s\"", aad(sa)->op);
}
printk(KERN_ERR "daozhelilema55? phph?\n");
if (aad(sa)->info) {
printk(KERN_ERR "daozhelilema66? phph?\n");
audit_log_format(ab, " info=\"%s\"", aad(sa)->info);
if (aad(sa)->error)
audit_log_format(ab, " error=%d", aad(sa)->error);
}
printk(KERN_ERR "daozhelilema77? phph?\n");
if (aad(sa)->label) {
struct aa_label *label = aad(sa)->label;
if (label_isprofile(label)) {
struct aa_profile *profile = labels_profile(label);
if (profile->ns != root_ns) {
audit_log_format(ab, " namespace=");
audit_log_untrustedstring(ab,
profile->ns->base.hname);
}
audit_log_format(ab, " profile=");
audit_log_untrustedstring(ab, profile->base.hname);
} else {
audit_log_format(ab, " label=");
aa_label_xaudit(ab, root_ns, label, FLAG_VIEW_SUBNS,
GFP_ATOMIC);
}
}
if (aad(sa)->name) {
audit_log_format(ab, " name=");
audit_log_untrustedstring(ab, aad(sa)->name);
}
}comon_lsm_audit函数中的打印语句也完善一下：
void common_lsm_audit(struct common_audit_data *a,
void (*pre_audit)(struct audit_buffer *, void *),
void (*post_audit)(struct audit_buffer *, void *))
{
struct audit_buffer *ab;
printk(KERN_ERR "daozhelilema? phph?\n");
if (a == NULL)
return;
/* we use GFP_ATOMIC so we won't sleep */
ab = audit_log_start(audit_context(), GFP_ATOMIC | __GFP_NOWARN,
AUDIT_AVC);
printk(KERN_ERR "daozhelilema2? phph?\n");
if (ab == NULL)
return;
printk(KERN_ERR "daozhelilema3? phph?\n");
if (pre_audit)
{
printk(KERN_ERR "daozhelilema4? phph?\n");
pre_audit(ab, a);
}
printk(KERN_ERR "daozhelilema5? phph?\n");
dump_common_audit_data(ab, a);
if (post_audit)
post_audit(ab, a);
audit_log_end(ab);
}重复前述步骤，最终看到/var/log/kern.log出现如下打印：
Apr 28 10:16:05 Ding-Perlis-MP260S48 kernel: [ 2254.729542] daozhelilema? phph?
Apr 28 10:16:05 Ding-Perlis-MP260S48 kernel: [ 2254.729559] daozhelilema2? phph?
Apr 28 10:16:05 Ding-Perlis-MP260S48 kernel: [ 2254.729563] daozhelilema3? phph?
Apr 28 10:16:05 Ding-Perlis-MP260S48 kernel: [ 2254.729566] daozhelilema4? phph?
Apr 28 10:16:05 Ding-Perlis-MP260S48 kernel: [ 2254.729569] daozhelilema11? phph?
Apr 28 10:16:05 Ding-Perlis-MP260S48 kernel: [ 2254.729573] daozhelilema22? phph?
Apr 28 10:16:05 Ding-Perlis-MP260S48 kernel: [ 2254.729577] daozhelilema33? phph?
Apr 28 10:16:05 Ding-Perlis-MP260S48 kernel: [ 2254.729580] daozhelilema44? phph?
Apr 28 10:16:05 Ding-Perlis-MP260S48 kernel: [ 2254.729584] daozhelilema55? phph?
Apr 28 10:16:05 Ding-Perlis-MP260S48 kernel: [ 2254.729587] daozhelilema77? phph?
Apr 28 10:16:05 Ding-Perlis-MP260S48 kernel: [ 2254.729591] daozhelilema5? phph?
这样看来是audit_pre函数已经调用到了，但是audit_log_format函数没有起作用。看一下其实现，在kernel/audit.c中，代码如下：
/**
* audit_log_format - format a message into the audit buffer.
* @ab: audit_buffer
* @fmt: format string
* @...: optional parameters matching @fmt string
*
* All the work is done in audit_log_vformat.
*/
void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
{
va_list args;
if (!ab)
return;
va_start(args, fmt);
audit_log_vformat(ab, fmt, args);
va_end(args);
}在audie_log_format函数中也加上打印，如下所示：
void audit_log_format(struct audit_buffer *ab, const char *fmt, ...)
{
va_list args;
printk(KERN_ERR "daozhelilema 88? phph?\n");
if (!ab)
return;
printk(KERN_ERR "daozhelilema 99? phph?\n");
va_start(args, fmt);
audit_log_vformat(ab, fmt, args);
va_end(args);
}重复前述步骤，最终看到/var/log/kern.log出现如下打印：
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269097] daozhelilema? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269113] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269117] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269121] daozhelilema2? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269125] daozhelilema3? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269128] daozhelilema4? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269132] daozhelilema11? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269135] daozhelilema22? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269139] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269142] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269146] daozhelilema33? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269150] daozhelilema44? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269153] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269157] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269160] daozhelilema55? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269164] daozhelilema77? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269167] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269171] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269175] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269178] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269182] daozhelilema5? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269185] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269189] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269193] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269197] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269200] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269204] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269207] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269211] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269214] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269218] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269233] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269236] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269240] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269244] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269248] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269251] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269255] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269258] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269265] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269268] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269274] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269277] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269281] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269284] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269295] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269298] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269302] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269305] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269309] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269312] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269321] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269324] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269328] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269331] daozhelilema 99? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269344] daozhelilema 88? phph?
Apr 28 10:55:39 Ding-Perlis-MP260S48 kernel: [ 300.269347] daozhelilema 99? phph?
可见，audit_log_format也进入了，并且ab这个指针变量也已经赋值。那么剩下的就只有va_start到va_end这一段代码了，核心函数是audit_log_vformat，其位于同文件（kernel/audit.c）中，就在audit_log_format函数的上边，代码如下：
/*
* Format an audit message into the audit buffer. If there isn't enough
* room in the audit buffer, more room will be allocated and vsnprint
* will be called a second time. Currently, we assume that a printk
* can't format message larger than 1024 bytes, so we don't either.
*/
static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
va_list args)
{
int len, avail;
struct sk_buff *skb;
va_list args2;
if (!ab)
return;
BUG_ON(!ab->skb);
skb = ab->skb;
avail = skb_tailroom(skb);
if (avail == 0) {
avail = audit_expand(ab, AUDIT_BUFSIZ);
if (!avail)
goto out;
}
va_copy(args2, args);
len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args);
if (len >= avail) {
/* The printk buffer is 1024 bytes long, so if we get
* here and AUDIT_BUFSIZ is at least 1024, then we can
* log everything that printk could have logged. */
avail = audit_expand(ab,
max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
if (!avail)
goto out_va_end;
len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
}
if (len > 0)
skb_put(skb, len);
out_va_end:
va_end(args2);
out:
return;
}在此函数中继续添加打印语句，如下所示：
static void audit_log_vformat(struct audit_buffer *ab, const char *fmt,
va_list args)
{
int len, avail;
struct sk_buff *skb;
va_list args2;
if (!ab)
return;
BUG_ON(!ab->skb);
skb = ab->skb;
printk(KERN_ERR "daozhelilema101010? phph?\n");
avail = skb_tailroom(skb);
if (avail == 0) {
avail = audit_expand(ab, AUDIT_BUFSIZ);
if (!avail)
{
printk(KERN_ERR "daozhelilema111111? phph?\n");
goto out;
}
}
printk(KERN_ERR "daozhelilema222222? phph?\n");
va_copy(args2, args);
len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args);
if (len >= avail) {
/* The printk buffer is 1024 bytes long, so if we get
* here and AUDIT_BUFSIZ is at least 1024, then we can
* log everything that printk could have logged. */
avail = audit_expand(ab,
max_t(unsigned, AUDIT_BUFSIZ, 1+len-avail));
if (!avail)
{
printk(KERN_ERR "daozhelilema333333? phph?\n");
goto out_va_end;
}
len = vsnprintf(skb_tail_pointer(skb), avail, fmt, args2);
}
if (len > 0)
{
printk(KERN_ERR "daozhelilema444444? phph?\n");
skb_put(skb, len);
}
out_va_end:
va_end(args2);
out:
return;
}重复前述步骤，最终看到/var/log/kern.log出现如下打印：
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498300] daozhelilema? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498315] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498318] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498323] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498326] daozhelilema2? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498329] daozhelilema3? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498332] daozhelilema4? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498336] daozhelilema11? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498339] daozhelilema22? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498342] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498345] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498349] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498352] daozhelilema33? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498355] daozhelilema44? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498358] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498361] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498365] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498368] daozhelilema55? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498371] daozhelilema77? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498374] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498377] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498380] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498384] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498387] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498390] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498394] daozhelilema5? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498397] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498400] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498403] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498408] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498411] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498414] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498417] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498420] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498423] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498427] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498430] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498433] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498436] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498439] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498442] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498458] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498462] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498465] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498469] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498471] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498475] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498478] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498481] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498485] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498489] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498492] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498496] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498501] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498504] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498509] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498512] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498515] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498518] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498523] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498526] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498529] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498538] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498541] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498545] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498548] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498552] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498555] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498558] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498561] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498564] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498570] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498574] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498577] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498580] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498583] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498586] daozhelilema444444? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498599] daozhelilema101010? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498602] daozhelilema222222? phph?
Apr 28 11:23:09 Ding-Perlis-MP260S48 kernel: [ 615.498606] daozhelilema444444? phph?
由此可见，自行加入的打印能够正常打印出来即产生在内核日志文件中（不包括if语句中的打印语句），而skb开头的相关语句仍然不能在内核日志中输出信息。
综上情况表明：没有日志的问题根源并不是AppArmor本身的问题，基本上可以断定是skb相关的内核代码及选项的问题。