Hello,
this issue is still reproducible with:
Debian: forky/sid
Kernel: 7.1.8+deb14.1-amd64
kea-common: 3.0.4-2
kea-dhcp4-server: 3.0.4-2
In my case AppArmor not only blocked kea-dhcp4 itself, but also
kea-lfc during the normal hourly lease file cleanup.
The Kea service runs as user _kea and /var/lib/kea is owned by
_kea:_kea, so normal Unix permissions were correct.
AppArmor denied kea-dhcp4 access to the normal memfile lease files:
apparmor="DENIED" operation="open" class="file"
profile="kea-dhcp4" name="/var/lib/kea/dhcp4.leases.2"
requested_mask="r" denied_mask="r"
apparmor="DENIED" operation="open" class="file"
profile="kea-dhcp4" name="/var/lib/kea/dhcp4.leases"
requested_mask="r" denied_mask="r"
apparmor="DENIED" operation="open" class="file"
profile="kea-dhcp4" name="/var/lib/kea/dhcp4.leases"
requested_mask="wc" denied_mask="wc"
There were also capability denials:
apparmor="DENIED" operation="capable" class="cap"
profile="kea-dhcp4" capability=2 capname="dac_read_search"
apparmor="DENIED" operation="capable" class="cap"
profile="kea-dhcp4" capability=1 capname="dac_override"
Additionally, the kea-lfc profile blocked the normal hourly Lease
File Cleanup:
apparmor="DENIED" operation="file_inherit" class="file"
profile="kea-lfc" name="/var/lib/kea/dhcp4.leases"
requested_mask="w" denied_mask="w"
apparmor="DENIED" operation="mknod" class="file"
profile="kea-lfc" name="/var/lib/kea/dhcp4.leases.pid"
requested_mask="c" denied_mask="c"
As a result, every hourly cleanup failed with:
LFC_FAIL_PID_CREATE : Unable to open PID file
'/var/lib/kea/dhcp4.leases.pid' for write
This was reproducible every hour.
After removing AppArmor, without changing the Kea configuration or
the ownership/permissions of /var/lib/kea, the cleanup immediately
started working normally.
Since then the hourly cleanup completes successfully with:
LFC_READ_STATS ... errors: 0
LFC_WRITE_STATS ... errors: 0
LFC_ROTATING LFC rotating files
LFC_TERMINATE LFC finished processing
The successful runs have continued every hour.
Therefore the AppArmor rules still seem to block paths and operations
which are part of normal Kea memfile operation, especially:
/var/lib/kea/dhcp4.leases
/var/lib/kea/dhcp4.leases.*
/var/lib/kea/dhcp4.leases.pid
I am adding this information to Bug #1032495 because the underlying
problem appears to be the same, and it is still present in
kea-dhcp4-server 3.0.4-2.
Regards,
Spock
