AppArmor breaks the default Unbound installation in a live session
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
apparmor (Ubuntu) |
New
|
Undecided
|
Unassigned | ||
unbound (Ubuntu) |
Triaged
|
Low
|
Unassigned |
Bug Description
Immediately after installing Unbound, it starts up normally. However, if you try to restart it afterwards (without changing anything), it fails with the following error message:
Aug 25 10:41:26 ubuntu unbound[6650]: /etc/unbound/
Aug 25 10:41:26 ubuntu unbound[6650]: read /etc/unbound/
Aug 25 10:41:26 ubuntu unbound[6650]: [1566729686] unbound[6650:0] fatal error: Could not read config file: /etc/unbound/
There *are* files matching the above glob pattern, however:
root@ubuntu:~# echo /etc/unbound/
/etc/unbound/
unbound-checkconf, on the other hand, determines the configuration to be fine:
root@ubuntu:~# unbound-checkconf
unbound-checkconf: no errors in /etc/unbound/
In the kernel log I can see that AppArmor is the probable culprit:
Aug 25 10:41:26 ubuntu kernel: audit: type=1400 audit(156672968
Steps to reproduce:
1. Download ubuntu-
2. Boot the downloaded ISO file in a virtual machine
3. Start gnome-terminal
4. sudo -i
5. apt-add-repository universe
6. apt -y install unbound
7. systemctl status unbound # verify that it is runnning
8. systemctl restart unbound
9. systemctl status unbound # verify that it failed to start
10. journalctl -kn1 # display AppArmor error message
Changed in unbound (Ubuntu): | |
status: | Incomplete → Confirmed |
summary: |
- AppArmor breaks the default Unbound installation + AppArmor breaks the default Unbound installation in a live session |
tags: | added: server-triage-discuss |
Changed in unbound (Ubuntu): | |
importance: | Undecided → Low |
status: | Confirmed → Triaged |
tags: | removed: server-triage-discuss |
The "/upper" dir in the apparmor denial message makes me suspect that unbound was installed in the livecd environment. @Tore, is that what you tried to do? Setting to incomplete while waiting for a confirmation on the livecd env.