Public bug reported:
After upgrading Ubuntu 26.04 from kernel 7.0.0-38-generic to
7.0.0-42-generic, nslookup executed inside Kubernetes containers
starts failing during shutdown.
DNS resolution succeeds, but nslookup terminates with:
isc_app_shutdown() kill: Permission denied
Segmentation fault (core dumped)
Kernel audit logs show AppArmor signal denials involving stacked
profiles.
The issue is reproducible and causes containerized applications
that rely on nslookup for readiness checks to hang indefinitely.
Booting back into kernel 7.0.0-38-generic immediately restores normal
behavior.
Expected Result:
nslookup should successfully resolve DNS names and exit normally.
No AppArmor signal denials should occur.
Actual Result:
DNS resolution succeeds but nslookup crashes during shutdown:
isc_app_shutdown() kill: Permission denied
Segmentation fault (core dumped)
AppArmor logs show DENIED signal operations.
Containerized applications that depend on nslookup may fail to
initialize.
Reproducer:
kubectl exec -it <pod> -- sh
nslookup pulsar-bookie
nslookup -timeout=10 pulsar-bookie | grep Name | wc -l
Result:
../../../lib/isc/app.c:399: fatal error:
isc_app_shutdown() kill: Permission denied
Segmentation fault (core dumped)
AppArmor Audit Record:
apparmor="DENIED"
operation="signal"
class="signal"
profile="nslookup"
requested_mask="receive"
denied_mask="receive"
signal=abrt
peer="cri-containerd.apparmor.d//&nslookup"
Regression Information:
Working:
Ubuntu 26.04
Kernel 7.0.0-38-generic
Failing:
Ubuntu 26.04
Kernel 7.0.0-42-generic
Why this appears to be a kernel/AppArmor regression:
The same container image, Kubernetes version, containerd
configuration and application configuration behave correctly
under kernel 7.0.0-38-generic.
Only the kernel version changes.
DNS itself is functional:
getent hosts pulsar-bookie
continues to work correctly under both kernels.
The failure is specific to nslookup and coincides with AppArmor
signal denials observed in the kernel audit log.
Environment:
K3s Version: v1.34.9+k3s1
AppAmor Version: 5.0.2
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172832
Title:
Compatibility Issue with Ubuntu 26.04 Kernel 7.0.0-42
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172832/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
