A similar failure was brought up as a follow-up to #2169218 [1],
affecting pmc replies in this case, rather than syslog:
"""
Markus Hofstaetter (hofstaettermait) wrote on 2026-10-13:
With the fix the ptp4l@ systemd unit still has issues sending messages
back to the pmc socket.
The reason is that the systemd unit creates a restricted namespace and
it becomes a disconnected path such that the rule won't apply and ptp4l
is denied again.
sudo journalctl -k --since "-1 h" --no-pager | grep 'apparmor="DENIED"' | grep
pmc | tail -1
sudo strace -f -p "$(systemctl show -p MainPID --value ptp4l@<your interface>)"
-e trace=recvfrom,recvmsg,sendto,sendmsg
A possible fix while keeping the namespace rules is to allow disconnected paths:
- profile ptp4l /usr/sbin/ptp4l {
+ profile ptp4l /usr/sbin/ptp4l flags=(attach_disconnected) {
""" [2]
As suggested both there and here, adding `attach_disconnected` does
appear to resolve this, however AppArmor documents this as unsafe [3],
stating "WARNING this mode is unsafe and can result in aliasing and
access to objects that should not be allowed. Its intent is a debug and
policy development tool.", so it may not be the correct fix here.
The narrower approach is to use a path-bound attach_disconnected with
explicit rules, e.g.:
```
profile ptp4l /usr/sbin/ptp4l flags=(attach_disconnected.path=/att/ptp4l/) {
...
@{run}/pmc.@{int} rw,
/att/ptp4l/run/pmc.@{int} rw,
/att/ptp4l/run/systemd/journal/dev-log w,
...
}
```
In my testing, this seems to address both the pmc reply failure and the
syslog failure reported here. Before proposing a concrete change,
hopefully others more familiar with LinuxPTP and AppArmor can weigh in
on the appropriate scope, whether there are other interactions to test
this for, and whether this is the preferred approach.
[1] https://bugs.launchpad.net/ubuntu/+source/linuxptp/+bug/2169218
[2] https://bugs.launchpad.net/ubuntu/+source/linuxptp/+bug/2169218/comments/6
[3]
https://manpages.debian.org/unstable/apparmor/apparmor.d.5.en.html#attach_disconnected
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2150639
Title:
LinuxPTP: Apparmor DENIED after upgrade to Ubuntu 26.04
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linuxptp/+bug/2150639/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
