Ubuntu 26.04 LTS AppArmor Denials Break Custom Service

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Custom service starts but cannot access files or sockets required for operation.

Environment & Reproduction

Common after deploying new binary paths under enforced AppArmor profiles.

sudo aa-status

Root Cause Analysis

Profile rules do not permit new file paths, capabilities, or network operations used by the app.

Quick Triage

Extract recent denial events from kernel and syslog output.

sudo journalctl -k | grep -i apparmor

Step-by-Step Diagnosis

Map denied operations to the exact profile currently enforcing.

sudo ausearch -m AVC,USER_AVC -ts recent

Solution – Primary Fix

Update profile allow rules with least privilege and reload AppArmor.

sudo apparmor_parser -r /etc/apparmor.d/ && sudo systemctl restart apparmor

Solution – Alternative Approaches

Use complain mode temporarily for diagnostics, then return to enforce mode after policy tuning.

Verification & Acceptance Criteria

Service functions as expected and no new denial events occur in normal workload.

Rollback Plan

Restore previous profile revision if new policy grants are too broad or unstable.

Prevention & Hardening

Version-control profiles and test policy changes in staging before production rollout.

Related Errors & Cross-Refs

Related to snap confinement denials and systemd service sandbox restrictions.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu AppArmor profile authoring and troubleshooting references.