Public bug reported:
On Ubuntu 26.04, the AppArmor profile shipped by apparmor-profiles for
samba-rpcd is missing permission for the local SAMR RPC socket:
@{run}/samba/ncalrpc/np/samr wr,
As a result, rpcd_lsad repeatedly receives AppArmor denials such as:
apparmor="DENIED" operation="file_receive" class="file" profile="samba-
rpcd" name="/run/samba/ncalrpc/np/samr" comm="rpcd_lsad"
requested_mask="wr" denied_mask="wr"
At the same time, winbindd repeatedly logs:
open_internal_samr_conn: Could not connect to samr pipe:
NT_STATUS_CONNECTION_DISCONNECTED
This causes samba-dcerpcd/winbindd to continuously create additional
rpcd_lsad helper processes without the old helpers exiting.
On my system this eventually reached approximately:
3,783 rpcd_lsad processes
~8.3 GB memory attributed to winbind.service
~7.0 GB swap used by winbind.service
~12 GB of 14 GB system RAM in use
The affected packages are:
apparmor 5.0.2-0ubuntu1~26.04.1
apparmor-profiles 5.0.2-0ubuntu1~26.04.1
apparmor-utils 5.0.2-0ubuntu1~26.04.1
samba 2:4.23.6+dfsg-1ubuntu2.2
samba-common 2:4.23.6+dfsg-1ubuntu2.2
samba-libs 2:4.23.6+dfsg-1ubuntu2.2
winbind 2:4.23.6+dfsg-1ubuntu2.2
The packaged /etc/apparmor.d/samba-rpcd profile currently allows:
@{run}/samba/ncalrpc/np/lsarpc wr,
@{run}/samba/ncalrpc/np/mdssvc wr,
@{run}/samba/ncalrpc/np/winreg wr,
but does not allow the samr endpoint.
Adding the following to /etc/apparmor.d/local/samba-rpcd:
@{run}/samba/ncalrpc/np/samr wr,
and reloading the AppArmor profile immediately stopped new denials.
After restarting only winbind.service, the rpcd_lsad count dropped from
3,783 to 2, winbind memory dropped to approximately 22 MB, winbind swap
usage dropped to 0, and available system memory returned to
approximately 10 GB.
This appears to be a missing rule in the shipped samba-rpcd AppArmor
profile. The profile should permit rpcd_lsad to access
/run/samba/ncalrpc/np/samr.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: apparmor-profiles 5.0.2-0ubuntu1~26.04.1
ProcVersionSignature: Ubuntu 7.0.0-31.31-generic 7.0.14
Uname: Linux 7.0.0-31-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: ubuntu:GNOME
Date: Sun Sep 13 17:04:21 2026
InstallationDate: Installed on 2023-06-04 (1197 days ago)
InstallationMedia: Ubuntu 23.04 "Lunar Lobster" - Release amd64 (20230418)
PackageArchitecture: all
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcKernelCmdline: BOOT_IMAGE=/boot/vmlinuz-7.0.0-31-generic
root=UUID=25a9e7d5-c483-4581-900e-03a4d5dfd5de ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: apparmor
UpgradeStatus: Upgraded to resolute on 2026-09-08 (5 days ago)
** Affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167200
Title:
apparmor-profiles: samba-rpcd missing SAMR socket permission causes
thousands of rpcd_lsad processes and severe memory/swap usage
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2167200/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
