Several things on unpack in that DENIED message: a) "sendmsg": something is trying to send a message. Given that "name" is a unix socket, it's presumably about writing to that socket.
b) rsyslogd profile is denying that operation c) comm(and) is "systemd-journal". That doesn't make sense. rsyslogd would not exec systemd-journal: that is a daemon. rsyslogd does link with libsystemd, though, so perhaps the library is doing something? d) denied_mask="r". What was denied was a read, not a write. That's weird. "sendmsg" implies a write, but a read was denied. The rsyslogd profile does allow a write to that dev-log socket (via the base abstraction), and not a read. But something tried to read from it. systemd-journal looks like, but why would that be confined by the rsyslog profile?? e) To check for (c), I ran execsnoop on the vm do see if I could catch an exec of systemd-journal, but no such exec happened. So current theory is that somehow by virtue of linking with libsystemd, rsyslogd is trying to read from dev-log and that is being denied. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2123821 Title: bad restriction: apparmor="DENIED" [...] namespace="root//lxd-n_<var- snap-lxd-common-lxd>" profile="rsyslogd" name="/run/systemd/journal/dev-log" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2123821/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
