debcrafters-packages team mailing list archive

Thread
Date

[Bug 2123821] Re: bad restriction: apparmor="DENIED" [...] namespace="root//lxd-n_<var-snap-lxd-common-lxd>" profile="rsyslogd" name="/run/systemd/journal/dev-log"

To: debcrafters-packages@xxxxxxxxxxxxxxxxxxx
From: Andreas Hasenack <2123821@xxxxxxxxxxxxxxxxxx>
Date: Tue, 16 Sep 2025 13:44:48 -0000
Reply-to: Bug 2123821 <2123821@xxxxxxxxxxxxxxxxxx>
Sender: noreply@xxxxxxxxxxxxx

But now a day later, launching a new questing container (and it
downloaded a new image, btw), I see the issue, with the same 5.21.4 lxd:

[Tue Sep 16 13:44:06 2025] audit: type=1400 audit(1758030246.890:584): apparmor="DENIED" operation="sendmsg" class="file" namespace="root//lxd-q_<var-snap-lxd-common-lxd>" profile="rsyslogd" name="/run/systemd/journal/dev-log" pid=9412 comm="systemd-journal" requested_mask="r" denied_mask="r" fsuid=1000000 ouid=1000000
[Tue Sep 16 13:44:07 2025] audit: type=1400 audit(1758030247.977:585): apparmor="DENIED" operation="sendmsg" class="file" namespace="root//lxd-q_<var-snap-lxd-common-lxd>" profile="rsyslogd" name="/run/systemd/journal/dev-log" pid=9412 comm="systemd-journal" requested_mask="r" denied_mask="r" fsuid=1000000 ouid=1000000


** Changed in: rsyslog (Ubuntu)
       Status: Incomplete => Confirmed

-- 
You received this bug notification because you are a member of
Debcrafters packages, which is subscribed to rsyslog in Ubuntu.
https://bugs.launchpad.net/bugs/2123821

Title:
  bad restriction: apparmor="DENIED" [...] namespace="root//lxd-n_<var-
  snap-lxd-common-lxd>" profile="rsyslogd"
  name="/run/systemd/journal/dev-log"

Status in apparmor package in Ubuntu:
  Invalid
Status in rsyslog package in Ubuntu:
  Confirmed

Bug description:
  On my Questing system running LXD containers, my kernel log is full of
  messages like:

  [  129.551382] audit: type=1400 audit(1757925628.229:1005):
  apparmor="DENIED" operation="sendmsg" class="file"
  namespace="root//lxd-q_<var-snap-lxd-common-lxd>" profile="rsyslogd"
  name="/run/systemd/journal/dev-log" pid=5370 comm="systemd-journal"
  requested_mask="r" denied_mask="r" fsuid=1000000 ouid=1000000

  One of my containers is named "q", hence the "root//lxd-q...". Some
  actual functionality is likely broken in the container.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2123821/+subscriptions