The net_admin denial is probably caused by a bug in systemd, see https://bugzilla.opensuse.org/show_bug.cgi?id=991901 and https://github.com/systemd/systemd/pull/10085 I'd recommend not to allow that capability in the nmbd profile, and instead apply the patch to systemd.
Write permissions to /run/systemd/notify look like a valid issue, I just opened https://gitlab.com/apparmor/apparmor/merge_requests/236 for that. ** Bug watch added: bugzilla.opensuse.org/ #991901 https://bugzilla.opensuse.org/show_bug.cgi?id=991901 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1719354 Title: apparmor blocking smbd which is in complain mode To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1719354/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
