Troubleshooting for AppArmor

The following table describes solutions to issues that you might encounter while using AppArmor .

IssueReasonSolution
After you run the File Export or File Import operation in the appliance, the following message appears in the logs:
type=AVC msg=audit(1594813145.658:7306): apparmor="DENIED" operation="exec" profile="/usr/sbin/apache2" name="/usr/lib/sftp-server" pid=58379 comm="bash" requested_mask="x"* denied_mask="x" *fsuid=0 ouid=0FSUID="root" OUID="root"
 Perform the following steps:
  1. On the CLI Manager, navigate to Administration → OS Console
  2. Navigate to the /etc/apparmor.d/custom directory.
  3. Edit the usr.sbin.apache2 profile.
  4. Insert the following line.
    /usr/lib/sftp-server rix,
  5. Restart the AppArmor service using the following command.
    /etc/init.d/apparmor restart
If a scheduler task containing a customized script is run, then the scheduled task is not executed and a denial message appears in the log. For example, if a task scheduler contains the /demo.sh script in the command line, the following message appears in the logs.
type=AVC msg=audit(1598429205.615:35253): apparmor="DENIED" operation="exec" profile="/usr/sbin/apache2" name="/demo.sh" pid=32684 comm=".taskV5FLVl.tmp" requested_mask="x" denied_mask="x" fsuid=0 ouid=0FSUID="root" OUID="root"
AppArmor restricts running any custom scripts from the scheduled taskPerform the following steps.
  1. On the CLI Manager, navigate to Administration → OS Console
  2. Navigate to the /etc/apparmor.d/custom directory.
  3. Edit the usr.sbin.apache2 profile.
  4. Insert the following line.
    /demo.sh rix,
  5. Restart the AppArmor service using the following command.
    /etc/init.d/apparmor restart
If you run the Put Files operation between two machines in a TAC, the following messages appear as logs in the source and target appliances.
Source appliance
type=AVC msg=audit(1598288495.530:5168): apparmor="DENIED" operation="mknod" profile="/etc/opt/Cluster/cluster_helper" name="/dummyfilefortest.sh" pid=62621 comm="mv" requested_mask="c" denied_mask="c" fsuid=0 ouid=0FSUID="root" OUID="root"
Target appliance
type=AVC msg=audit(1598288495.950:2116): apparmor="DENIED" operation="chown" profile="/etc/opt/Cluster/cluster_helper" name="/dummyfilefortest.sh" pid=17413 comm="chown" requested_mask="w" denied_mask="w" fsuid=0 ouid=0FSUID="root" OUID="root"
 Perform the following steps.
  1. On the CLI Manager, navigate to Administration → OS Console
  2. Navigate to the /etc/apparmor.d/custom directory.
  3. Edit the etc.opt.Cluster.cluster_helper profile.
  4. Insert the following line on the source appliance
    /<filename> cix,
  5. Insert the following line on the target appliance
    /<filename> wix,
  6. Restart the AppArmor service on the source and target appliances using the following command.
    /etc/init.d/apparmor restart
Last modified February 7, 2025