Public bug reported: ## Summary
`wg-quick up|down <iface>` reliably segfaults (signal 11) on Ubuntu 26.04 with the shipped `wg-quick` AppArmor profile enforced. The profile denies `mmap`/read access to `/usr/bin/bash` - the interpreter the kernel loads via wg-quick's own `#!/bin/bash` shebang - so any direct invocation of `/usr/bin/wg-quick` (interactively, via PATH, or via its own `[email protected]` systemd unit) crashes. ## Environment - Ubuntu 26.04 ("Resolute Raccoon") - `wireguard-tools` 1.0.20250521-1ubuntu1 - `apparmor` profiles `wg` and `wg-quick` (+ `wg-quick//ip`, `wg-quick//nft`, `wg-quick//sysctl`) loaded and enforced by default - Reproduced inside an unprivileged Proxmox LXC; nothing in the profile gap looks LXC-specific, but not yet confirmed on bare metal. ## Reproduction ``` $ wg genkey > /etc/wireguard/privatekey $ wg pubkey < /etc/wireguard/privatekey > /etc/wireguard/publickey $ cat > /etc/wireguard/wgtest.conf <<EOF [Interface] Address = 10.90.90.250/32 PrivateKey = $(cat /etc/wireguard/privatekey) [Peer] PublicKey = $(cat /etc/wireguard/publickey) AllowedIPs = 10.90.90.251/32 EOF $ chmod 600 /etc/wireguard/wgtest.conf $ wg-quick up wgtest Segmentation fault ``` 100% reproducible (10/10 in testing) via direct invocation, `sudo`, and as a systemd unit. ## Root cause `journalctl -k` on the host shows the denial at the moment of the crash: ``` audit: type=1400 audit(...): apparmor="DENIED" operation="file_mmap" class="file" profile="wg-quick" name="/usr/bin/bash" pid=... comm="wg-quick" requested_mask="r" denied_mask="r" ``` `/etc/apparmor.d/wg-quick` grants `file mr @{exec_path}` - read+mmap only for the profile's own attach path (`/usr/bin/wg-quick`). It never grants that for `/usr/bin/bash`. Since wg-quick is a bash script rather than a compiled binary, the kernel's shebang handling execs `/usr/bin/bash` as the actual running image; AppArmor denies mapping that interpreter binary, and bash dies with SIGSEGV instead of a clean exec failure. ## Confirmation Unloading both profiles removes the crash entirely, with everything else unchanged: ``` $ apparmor_parser -R /etc/apparmor.d/wg-quick $ apparmor_parser -R /etc/apparmor.d/wg $ for i in $(seq 1 10); do wg-quick up wgtest; wg-quick down wgtest; done # 10/10 clean exits (rc=0), zero segfaults $ apparmor_parser -r /etc/apparmor.d/wg $ apparmor_parser -r /etc/apparmor.d/wg-quick $ wg-quick up wgtest Segmentation fault # crash returns immediately on reload ``` Note on a false lead: invoking `bash -x /usr/bin/wg-quick up wgtest` (rather than `wg-quick up wgtest` or `/usr/bin/wg-quick up wgtest`) appeared to "fix" the crash and was initially mistaken for a bash 5.3 timing issue. It actually works because AppArmor's profile attachment is keyed to executing `/usr/bin/wg-quick` directly; execing `/usr/bin/bash` with the script as an argument is a different exec target that the `wg-quick` profile never attaches to, so it runs unconfined. The `-x` flag was incidental - confirmed `bash /usr/bin/wg-quick up wgtest` (no `-x`) sidesteps the crash the same way. ## Suggested fix Add an `mr` (or equivalent `Px`/`ix`) rule for the shell interpreter to `/etc/apparmor.d/wg-quick`, e.g. via the `abstractions/base` include (it's already included but apparently doesn't cover this) or an explicit `file mr /usr/bin/bash,` line matching whatever `#!` wg-quick ships with. --- Investigated and drafted with AI assistance (Claude); reviewed by a human before submission. ** Affects: wireguard-tools (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2165046 Title: wg-quick SIGSEGV: shipped AppArmor profile denies mmap of /usr/bin/bash To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/wireguard-tools/+bug/2165046/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
