Jan 02 12:08:44 audit[24401]: AVC apparmor="DENIED" operation="open" profile="samba-dcerpcd" name="/var/cache/samba/names.tdb" pid=24401 comm="samba-dcerpcd" requested_mask="wrc" denied_mask="wrc" fsuid=0 ouid=0 Jan 02 12:08:44 audit[24401]: SYSCALL arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7ffedf610440 a2=80042 a3=1b0 items=0 ppid=24400 pid=24401 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="samba-dcerpcd" exe="/usr/lib/samba/samba/samba-dcerpcd" subj=samba-dcerpcd key=(null) Jan 02 12:08:44 audit: PROCTITLE proctitle=2F7573722F6C69622F73616D62612F73616D62612F73616D62612D64636572706364002D2D6C6962657865632D7270636473002D2D72656164792D7369676E616C2D66643D3330002D2D6E702D68656C706572002D2D64656275676C6576656C3D30 Jan 02 12:08:44 kernel: audit: type=1400 audit(1672690124.038:710): apparmor="DENIED" operation="open" profile="samba-dcerpcd" name="/var/cache/samba/names.tdb" pid=24401 comm="samba-dcerpcd" requested_mask="wrc" denied_mask="wrc" fsuid=0 ouid=0 Jan 02 12:08:44 kernel: audit: type=1300 audit(1672690124.038:710): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7ffedf610440 a2=80042 a3=1b0 items=0 ppid=24400 pid=24401 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="samba-dcerpcd" exe="/usr/lib/samba/samba/samba-dcerpcd" subj=samba-dcerpcd key=(null) Jan 02 12:08:44 kernel: audit: type=1327 audit(1672690124.038:710): proctitle=2F7573722F6C69622F73616D62612F73616D62612F73616D62612D64636572706364002D2D6C6962657865632D7270636473002D2D72656164792D7369676E616C2D66643D3330002D2D6E702D68656C706572002D2D64656275676C6576656C3D30 ================================ After adding exception for above ================================ Jan 02 12:23:05 audit[25718]: AVC apparmor="DENIED" operation="open" profile="samba-dcerpcd" name="/run/samba-dcerpcd.pid" pid=25718 comm="samba-dcerpcd" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0 Jan 02 12:23:05 audit[25718]: SYSCALL arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7ffc0d3c9f30 a2=841 a3=1a4 items=0 ppid=1 pid=25718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="samba-dcerpcd" exe="/usr/lib/samba/samba/samba-dcerpcd" subj=samba-dcerpcd key=(null) Jan 02 12:23:05 audit: PROCTITLE proctitle=2F7573722F6C69622F73616D62612F73616D62612F73616D62612D64636572706364002D2D6C6962657865632D7270636473002D2D72656164792D7369676E616C2D66643D3330002D2D6E702D68656C706572002D2D64656275676C6576656C3D30 Jan 02 12:23:05 kernel: kauditd_printk_skb: 192 callbacks suppressed Jan 02 12:23:05 kernel: audit: type=1400 audit(1672690985.921:1069): apparmor="DENIED" operation="open" profile="samba-dcerpcd" name="/run/samba-dcerpcd.pid" pid=25718 comm="samba-dcerpcd" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0 Jan 02 12:23:05 kernel: audit: type=1300 audit(1672690985.921:1069): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7ffc0d3c9f30 a2=841 a3=1a4 items=0 ppid=1 pid=25718 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="samba-dcerpcd" exe="/usr/lib/samba/samba/samba-dcerpcd" subj=samba-dcerpcd key=(null) Jan 02 12:23:05 kernel: audit: type=1327 audit(1672690985.921:1069): proctitle=2F7573722F6C69622F73616D62612F73616D62612F73616D62612D64636572706364002D2D6C6962657865632D7270636473002D2D72656164792D7369676E616C2D66643D3330002D2D6E702D68656C706572002D2D64656275676C6576656C3D30 ================================== Denials when samba attempts to log ================================== Jan 02 12:37:57 audit[26656]: AVC apparmor="DENIED" operation="open" profile="samba-rpcd-classic" name=2F6D6E742F4D792050617373706F72742F4D6973632F444C2F pid=26656 comm="rpcd_classic" requested_mask="r" denied_mask="r" fsuid=0 ouid=1000 Jan 02 12:37:57 audit[26656]: SYSCALL arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=55ba14f29960 a2=90800 a3=0 items=0 ppid=26646 pid=26656 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rpcd_classic" exe="/usr/lib/samba/samba/rpcd_classic" subj=samba-rpcd-classic key=(null) Jan 02 12:37:57 audit: PROCTITLE proctitle=2F7573722F6C69622F73616D62612F73616D62612F727063645F636C6173736963002D2D636F6E66696766696C653D2F6574632F73616D62612F736D622E636F6E66002D2D776F726B65722D67726F75703D36002D2D776F726B65722D696E6465783D30002D2D64656275676C6576656C3D30 Jan 02 12:37:57 rpcd_classic[26656]: [2023/01/02 12:37:57.393208, 0] ../../lib/util/debug.c:1264(reopen_one_log) Jan 02 12:37:57 rpcd_classic[26656]: reopen_one_log: Unable to open new log file '/var/log/samba/log.rpcd_classic': Permission denied Jan 02 12:37:57 rpcd_classic[26656]: [2023/01/02 12:37:57.393427, 0] ../../lib/util/debug.c:1264(reopen_one_log) Jan 02 12:37:57 rpcd_classic[26656]: reopen_one_log: Unable to open new log file '/var/log/samba/log.rpcd_classic': Permission denied Jan 02 12:37:57 rpcd_classic[26656]: [2023/01/02 12:37:57.393480, 0] ../../lib/util/debug.c:1264(reopen_one_log) Jan 02 12:37:57 rpcd_classic[26656]: reopen_one_log: Unable to open new log file '/var/log/samba/log.rpcd_classic': Permission denied