# Problem with pam\_apparmor
**URL:** https://forums.suse.com/t/problem-with-pam-apparmor/22655
**Category:** SLES Configure-Administer
**Created:** [May 22, 2012, 9:15pm UTC](https://forums.suse.com/t/problem-with-pam-apparmor/22655 "2012-05-22T21:15:43Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@ybilodeau](https://forums.suse.com/u/ybilodeau)
#### Post date: [May 22, 2012, 9:15pm UTC](https://forums.suse.com/t/problem-with-pam-apparmor/22655/1 "2012-05-22T21:15:43Z")
Hello,
we have implemented some rbac features using pam\_apparmor. This works great with SLES 11SP1 (apparmor 2.3) but fails with SLES 11SP2 (apparmor 2.5.1).
Looking at /var/log/audit/audit.log, I get the following messages:
type=AVC msg=audit(1337709758.374:328): apparmor=“KILLED” operation=“change\_hat” parent=6121 profile="/usr/sbin/sshd//root" pid=6719 comm=“sshd” target="/usr/sbin/sshd//root"
type=AVC msg=audit(1337709781.458:329): apparmor=“DENIED” operation=“change\_hat” info=“unconfined” error=-1 pid=6722 comm=“cron”
type=AVC msg=audit(1337709781.458:330): apparmor=“DENIED” operation=“change\_hat” info=“unconfined” error=-1 pid=6722 comm=“cron”
…
Some googling tells me the apparmor=“DENIED” messages are superfluous messages that can be ignored.
On the other hand, the apparmor=“KILLED” message has absolutely no match in google (even if I limit the search to that term alone). I noticed an updated kernel (3.0.26-0.7-default), which I installed, but it did not help.
I am about to look at the kernel code itself to get a better idea of what is going on, but I would appreciate if anyone has an idea about it!
---
### Author:  [@system](https://forums.suse.com/u/system)
#### Post date: [May 31, 2012, 3:30pm UTC](https://forums.suse.com/t/problem-with-pam-apparmor/22655/2 "2012-05-31T15:30:46Z")
ybilodeau,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your issue been resolved? If not, you might try one of the following options:
- Visit [http://www.suse.com/support](http://www.suse.com/support) and search the knowledgebase and/or check all
the other support options available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. ([http://forums.suse.com](http://forums.suse.com))
Be sure to read the forum FAQ about what to expect in the way of responses:
[http://forums.suse.com/faq.php](http://forums.suse.com/faq.php)
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your SUSE Forums Team
[http://forums.suse.com](http://forums.suse.com)
---
### Author:  [@ybilodeau](https://forums.suse.com/u/ybilodeau)
#### Post date: [June 19, 2012, 4:36pm UTC](https://forums.suse.com/t/problem-with-pam-apparmor/22655/3 "2012-06-19T16:36:53Z")
This has been resolved
Just so everyone knows what went wrong, it is because starting at SLES 11 SP2 (and OpenSuse 11.4 - I did not test prior versions), the pam\_apparmor rpm has a postinstall script that does the following:
pam-config -a --apaprmor
pam-config --update
This has the effect of adding the pam\_apparmor.so library in /etc/pam.d/common-session, while I was adding it myself to /etc/pam.d/sshd.
It would appear that pam does not like to load the same library twice.
Removing the lines in common-session fix the problem. I know the usage of pam\_apparmor is very limited worldwide, but thanks anyways to everyone who looked at my post and thought about my issue!