AppArmor denies container runtime file access

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

A confined workload fails because AppArmor blocks required file operations.

Environment & Reproduction

Application logs show permission denied while kernel audit entries reference apparmor=DENIED.

Root Cause Analysis

Review dmesg or journalctl -k, run aa-status, and identify active profile for the process.

Quick Triage

Profile rules do not include new path access patterns introduced by an update or mount change.

Step-by-Step Diagnosis

Adjust the AppArmor profile with required read or write rules and reload with apparmor_parser.

Solution – Primary Fix

Confirm workload starts normally and no new DENIED events appear in journalctl.

Solution – Alternative Approaches

Version profile changes alongside application deployments and test in staging first.

Verification & Acceptance Criteria

Temporarily place profile in complain mode while refining least-privilege rules.

Rollback Plan

Use deployment hooks to validate profiles with syntax and smoke tests.

Prevention & Hardening

aa-status; journalctl -k | grep apparmor; aa-complain ; apparmor_parser -r

Related Errors & Cross-Refs

Submit denial logs, profile file, and reproducer steps to security engineering.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Snap and LXD workloads use AppArmor extensively, so profile drift often appears after upgrades.