openvpn no longer works on Ubuntu 26.04 #20

fkooman commented 2026年03月30日 19:21:14 +02:00

Mar 30 17:19:52 ubunext.tuxed.net kernel: audit: type=1400 audit(1774891192.831:341): apparmor="DENIED" operation="mknod" class="file" profile="openvpn" name="/run/openvpn-server/default-1.sock" pid=3484 comm="openvpn" requested_mask="c" denied_mask="c" fsuid=0 ouid=0

We probably need to modify the apparmor profile in /etc/apparmor.d/openvpn (or similar) to give it access to this path, or figure out if there's another place where apparmor would allow this and use that as a socket location.

``` Mar 30 17:19:52 ubunext.tuxed.net kernel: audit: type=1400 audit(1774891192.831:341): apparmor="DENIED" operation="mknod" class="file" profile="openvpn" name="/run/openvpn-server/default-1.sock" pid=3484 comm="openvpn" requested_mask="c" denied_mask="c" fsuid=0 ouid=0 ``` We probably need to modify the apparmor profile in `/etc/apparmor.d/openvpn` (or similar) to give it access to this path, *or* figure out if there's another place where apparmor would allow this and use that as a socket location.

fkooman commented 2026年03月30日 19:29:28 +02:00

More issues:

Mar 30 17:29:04 ubunext.tuxed.net kernel: audit: type=1400 audit(1774891744.557:553): apparmor="DENIED" operation="mknod" class="file" profile="openvpn" name="/tmp/openvpn_cc_7927db93d788700777dc8e98bbf26956.tmp" pid=4922 comm="openvpn" requested_mask="c" denied_mask="c" fsuid=65534 ouid=65534
Mar 30 17:29:04 ubunext.tuxed.net kernel: audit: type=1400 audit(1774891744.558:554): apparmor="DENIED" operation="exec" class="file" profile="openvpn" name="/usr/libexec/vpn-server-node/client-disconnect" pid=5251 comm="openvpn" requested_mask="x" denied_mask="x" fsuid=65534 ouid=0

More issues: ``` Mar 30 17:29:04 ubunext.tuxed.net kernel: audit: type=1400 audit(1774891744.557:553): apparmor="DENIED" operation="mknod" class="file" profile="openvpn" name="/tmp/openvpn_cc_7927db93d788700777dc8e98bbf26956.tmp" pid=4922 comm="openvpn" requested_mask="c" denied_mask="c" fsuid=65534 ouid=65534 Mar 30 17:29:04 ubunext.tuxed.net kernel: audit: type=1400 audit(1774891744.558:554): apparmor="DENIED" operation="exec" class="file" profile="openvpn" name="/usr/libexec/vpn-server-node/client-disconnect" pid=5251 comm="openvpn" requested_mask="x" denied_mask="x" fsuid=65534 ouid=0 ```

fkooman commented 2026年03月30日 19:30:24 +02:00

The first issue can be fixed with this:

 # OpenVPN allow creating sockets
 file rw /run/openvpn-server/*.sock,

The first issue can be fixed with this: ``` # OpenVPN allow creating sockets file rw /run/openvpn-server/*.sock, ```

fkooman commented 2026年03月30日 20:14:06 +02:00

Fix for all of them:

 file rw /run/openvpn-server/*.sock,
 file ux /usr/libexec/vpn-server-node/client-{,dis}connect,
 file rw /tmp/openvpn_cc{,r}_*.tmp,

Fix for all of them: ``` file rw /run/openvpn-server/*.sock, file ux /usr/libexec/vpn-server-node/client-{,dis}connect, file rw /tmp/openvpn_cc{,r}_*.tmp, ```

fkooman commented 2026年03月30日 20:16:10 +02:00

So far my fix is to add this to /etc/apparmor.d/openvpn and then reload the "profile":

$ sudo apparmor_parser -r /etc/apparmor.d/openvpn

So far my fix is to add this to `/etc/apparmor.d/openvpn` and then reload the "profile": ``` $ sudo apparmor_parser -r /etc/apparmor.d/openvpn ```

fkooman commented 2026年03月30日 21:42:41 +02:00

It is possible to create local overrides in /etc/apparmor.d/local.

It is possible to create local overrides in `/etc/apparmor.d/local`.

fkooman commented 2026年03月30日 21:43:20 +02:00

See: https://gitlab.com/apparmor/apparmor/-/wikis/denial_quick_guide

See: https://gitlab.com/apparmor/apparmor/-/wikis/denial_quick_guide

fkooman commented 2026年03月31日 18:46:01 +02:00

Fixed for server.

Fixed for *server*.