Public bug reported:
On Ubuntu 26.04 (resolute), the AppArmor profiles shipped by lenovo-fccunlock
and
lenovo-cfgservice (2.0.0-0ubuntu3) prevent the FCC unlock from working, because
coreutils is now provided by rust-coreutils.
Both profiles allow "/usr/bin/ls ix," and "/usr/bin/cut ix,". On 26.04 these
resolve to /usr/lib/cargo/bin/coreutils/ls and /usr/lib/cargo/bin/coreutils/cut,
and AppArmor mediates the resolved path, so the exec is denied. The unlock
service
then fails and ModemManager gives up.
Hardware: ThinkPad X1 Carbon Gen 14, Foxconn T99W696 (Qualcomm SDX61,
17cb:0308).
Steps to reproduce:
1. Ubuntu 26.04, lenovo-fccunlock + lenovo-cfgservice installed, supported WWAN
module + SIM.
2. sudo mmcli -m any -e
Actual result:
error: couldn't enable the modem: Retry: Invalid transition
ModemManager: [fcc unlock dispatcher] forcing exit on fcc unlock operation
kernel: apparmor="DENIED" operation="exec"
profile="/opt/fcc_lenovo/DPR_Fcc_unlock_service"
name="/usr/lib/cargo/bin/coreutils/ls" requested_mask="x"
kernel: apparmor="DENIED" operation="exec"
profile="/opt/fcc_lenovo/configservice_lenovo"
name="/usr/lib/cargo/bin/coreutils/ls" requested_mask="x"
configservice_lenovo: sh: 1: ls: Permission denied
Expected result:
FCC unlock succeeds and the modem is enabled.
Workaround / verification:
With both profiles in complain mode the unlock succeeds, the modem registers
(LTE + 5G NR) and mobile data works. Adding the following to both profiles fixes
the ls/cut denials:
/usr/lib/cargo/bin/coreutils/ls ix,
/usr/lib/cargo/bin/coreutils/cut ix,
Suggested fix: allow the rust-coreutils paths (or both paths) in the profiles.
Note: the profiles also have no "include if exists <local/...>" hook, so users
cannot add local overrides without editing the conffiles.
Disclosure: the packaged 2.0.0 has no unlock script for 17cb:0308, so the
binaries
from upstream github.com/lenovo/lenovo-wwan-unlock were installed over the
packaged
ones in order to test. The ls/cut denial is in the profile itself and not
specific
to that binary version. Further denials seen with the upstream binaries
(libfiisdk.so.2.2.2, mmcli exec in configservice_lenovo) are omitted here since
they likely stem from the newer upstream version. A separate request to update
the
package to the current upstream release (SDX61 / X1 Carbon Gen 14 support) will
follow.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: lenovo-fccunlock 2.0.0-0ubuntu3 [modified:
opt/fcc_lenovo/DPR_Fcc_unlock_service
usr/lib/x86_64-linux-gnu/ModemManager/fcc-unlock.d/14c3:4d75
usr/lib/x86_64-linux-gnu/ModemManager/fcc-unlock.d/1eac:1007
usr/lib/x86_64-linux-gnu/ModemManager/fcc-unlock.d/1eac:100d
usr/lib/x86_64-linux-gnu/ModemManager/fcc-unlock.d/2c7c:6008
usr/lib/x86_64-linux-gnu/ModemManager/fcc-unlock.d/8086:7560]
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Sat Oct 3 10:57:20 2026
InstallationDate: Installed on 2026-07-20 (75 days ago)
InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1)
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
SourcePackage: lenovo-wwan-unlock
UpgradeStatus: No upgrade log present (probably fresh install)
mtime.conffile..etc.apparmor.d.opt.fcc_lenovo.DPR_Fcc_unlock_service:
2026-10-03T10:54:21.691519
** Affects: lenovo-wwan-unlock (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169393
Title:
AppArmor profiles block FCC unlock on 26.04: /usr/bin/ls and
/usr/bin/cut resolve to rust-coreutils paths
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/lenovo-wwan-unlock/+bug/2169393/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
