[SOLVED] Issue with AppArmor : bad configuration

E

Ernie95

Member
Sep 1, 2025
30
2
8
Hi all,

I used the lxc containers with Adguardhome (script from Proxmox VE helper script). It works fine and it’s Debian 12.12
I installed kea-dhcp-server. The logger_logfile is in /run/kea/logger_lockfile

But in apparmor file in /etc/apparmor.d/usr.sbin.kea-dhcp4 (in the container), the rule is
owner /run/lock/kea/logger_lockfile rwk,

The path is not the good path.
This issue comes from installation (apt-get install and no modification on my side)

First, can I modify the apparmor file ? And is the modification persistant after reboot ?

Secondly, where can I explain this bug as it is not proxmox ?

Thanks
 
I modified the file /etc/apparmor.d/usr.sbin.kea-dhcp4. It works fine: no error in log file. It is persistent (except if update of packet).
 
not solved
Code: 
Sep 22 17:20:31 pve kernel: audit: type=1400 audit(1758554431.393:455): apparmor="DENIED" operation="file_lock" class="file" profile="kea-lfc" name="/run/lock/kea/logger_lockfile" pid=2066 comm="kea-dhcp4" requested_mask="k" denied_mask="k" fsuid=108 ouid=108

It is not persistent : the file /etc/apparmor.d/usr.sbin.kea-dhcp4 has now again the bad path.

Thanks for any advice
 
Last edited:
Hi,
I modified the profile :
In the file on the node shell : /etc/apparmor.d/usr.sbin.kea-lfc
I modified : owner /run/lock/kea/logger_lockfile rw,
by : owner /run/lock/kea/logger_lockfile rwk,

I save.

In the LXC container : same action : modification of /etc/apparmor.d/usr.sbin.kea-lfc

Then in the node shell : service apparmor reload

Since the modification no error in the log :
Code: 
pve kernel: audit: type=1400 audit(1758554431.393:455): apparmor="DENIED" operation="file_lock" class="file" profile="kea-lfc" name="/run/lock/kea/logger_lockfile" pid=2066 comm="kea-dhcp4" requested_mask="k" denied_mask="k" fsuid=108 ouid=108

I will wait several hours to be sure

BR
 
You must log in or register to reply here.
Top Bottom