9
6
Fork
You've already forked deploy
1

no DCO with OpenVPN on Ubuntu 26.04 #21

Closed
opened 2026年03月31日 09:17:30 +02:00 by fkooman · 19 comments 
Mar 31 07:15:58 resolute.tuxed.net openvpn[1716]: --user specified but lacking CAP_SETPCAP. Cannot retain CAP_NET_ADMIN. Disabling data channel offload
Mar 31 07:15:58 resolute.tuxed.net openvpn[1716]: OpenVPN 2.7.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
Mar 31 07:15:58 resolute.tuxed.net openvpn[1716]: library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
Mar 31 07:15:58 resolute.tuxed.net openvpn[1716]: DCO version: N/A
``` Mar 31 07:15:58 resolute.tuxed.net openvpn[1716]: --user specified but lacking CAP_SETPCAP. Cannot retain CAP_NET_ADMIN. Disabling data channel offload Mar 31 07:15:58 resolute.tuxed.net openvpn[1716]: OpenVPN 2.7.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO] Mar 31 07:15:58 resolute.tuxed.net openvpn[1716]: library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10 Mar 31 07:15:58 resolute.tuxed.net openvpn[1716]: DCO version: N/A ```
Author
Owner
Copy link

Lots of crap here in this mailing list thread, with no solution:

https://sourceforge.net/p/openvpn/mailman/openvpn-users/thread/ZTu6QNmtM4r9MeC5%40greenie.muc.de/

(The capabilities in the Ubuntu provided openvpn-server@.service file are identical to the ones upstream 🤷)

Lots of crap here in this mailing list thread, with no solution: https://sourceforge.net/p/openvpn/mailman/openvpn-users/thread/ZTu6QNmtM4r9MeC5%40greenie.muc.de/ (The capabilities in the Ubuntu provided openvpn-server@.service file are identical to the ones upstream 🤷)
Author
Owner
Copy link
--user specified but lacking CAP_SETPCAP. Cannot retain CAP_NET_ADMIN. Disabling data channel offload

$ systemctl cat openvpn-server@ | grep CAP_SETPCAP
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SETPCAP CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_SYS_NICE CAP_AUDIT_WRITE
``` --user specified but lacking CAP_SETPCAP. Cannot retain CAP_NET_ADMIN. Disabling data channel offload ``` ``` $ systemctl cat openvpn-server@ | grep CAP_SETPCAP CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SETPCAP CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_SYS_NICE CAP_AUDIT_WRITE ```
Author
Owner
Copy link

Turns out also an AppArmor issue:

#20

We can fix it by adding the capability to our local override:

capability setpcap,

We should probably file this upstream...

Turns out _also_ an AppArmor issue: https://codeberg.org/eduVPN/deploy/issues/20 We can fix it by adding the capability to our local override: ``` capability setpcap, ``` We should probably file this upstream...
Author
Owner
Copy link

Now it works:

Mar 31 07:47:15 resolute.tuxed.net openvpn[1033]: OpenVPN 2.7.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
Mar 31 07:47:15 resolute.tuxed.net openvpn[1033]: DCO version: 7.0.0-10-generic #10-Ubuntu SMP PREEMPT_DYNAMIC Thu Mar 19 10:24:42 UTC 2026
Mar 31 07:47:15 resolute.tuxed.net openvpn[1033]: DCO device tun0 opened
Now it works: ``` Mar 31 07:47:15 resolute.tuxed.net openvpn[1033]: OpenVPN 2.7.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO] Mar 31 07:47:15 resolute.tuxed.net openvpn[1033]: DCO version: 7.0.0-10-generic #10-Ubuntu SMP PREEMPT_DYNAMIC Thu Mar 19 10:24:42 UTC 2026 Mar 31 07:47:15 resolute.tuxed.net openvpn[1033]: DCO device tun0 opened ```

These issue looks related:
https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/issues/103
https://github.com/OpenVPN/openvpn/issues/869

@fkooman wrote in #21 (comment):

Turns out also an AppArmor issue:

#20

We can fix it by adding the capability to our local override:

capability setpcap,

We should probably file this upstream...

It would be great to have this properly fixed upstream everywhere...

These issue looks related: https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/issues/103 https://github.com/OpenVPN/openvpn/issues/869 @fkooman wrote in https://codeberg.org/eduVPN/deploy/issues/21#issuecomment-12464769: > Turns out _also_ an AppArmor issue: > > #20 > > We can fix it by adding the capability to our local override: > > ```text > capability setpcap, > ``` > > We should probably file this upstream... It would be great to have this properly fixed upstream everywhere...
Author
Owner
Copy link

@FabioPedretti wrote in #21 (comment):

It would be great to have this properly fixed upstream everywhere...

I'm testing on Ubuntu 26.04 desktop, which should work without issues, including with DCO. But I already get stuck with the first AppArmor message:

Mar 31 16:29:09 frabuntu kernel: audit: type=1400 audit(1774967349.408:261): apparmor="DENIED" operation="open" class="file" profile="openvpn" name="/run/NetworkManager/cert/XYqn6K" pid=6275 comm="openvpn" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
@FabioPedretti wrote in https://codeberg.org/eduVPN/deploy/issues/21#issuecomment-12478356: > It would be great to have this properly fixed upstream everywhere... I'm testing on Ubuntu 26.04 desktop, which should work without issues, including with DCO. But I already get stuck with the first AppArmor message: ``` Mar 31 16:29:09 frabuntu kernel: audit: type=1400 audit(1774967349.408:261): apparmor="DENIED" operation="open" class="file" profile="openvpn" name="/run/NetworkManager/cert/XYqn6K" pid=6275 comm="openvpn" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 ```
Author
Owner
Copy link

DCO still doesn't work, also not when setting the capability. On the Ubuntu desktop I now have this:

file r @{run}/NetworkManager/cert/@{rand6},
capability setpcap,

But still no DCO:

Mar 31 16:35:30 frabuntu nm-openvpn[6913]: OpenVPN 2.7.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
Mar 31 16:35:30 frabuntu nm-openvpn[6913]: library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
Mar 31 16:35:30 frabuntu nm-openvpn[6913]: DCO version: N/A
DCO still doesn't work, also not when setting the capability. On the Ubuntu desktop I now have this: ``` file r @{run}/NetworkManager/cert/@{rand6}, capability setpcap, ``` But still no DCO: ``` Mar 31 16:35:30 frabuntu nm-openvpn[6913]: OpenVPN 2.7.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO] Mar 31 16:35:30 frabuntu nm-openvpn[6913]: library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10 Mar 31 16:35:30 frabuntu nm-openvpn[6913]: DCO version: N/A ```
Author
Owner
Copy link

When I start OpenVPN from the cli directly, there is DCO, so something must be going wrong somewhere, it is not clear from the logs though...

2026年03月31日 16:40:24 OpenVPN 2.7.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
2026年03月31日 16:40:24 library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10
2026年03月31日 16:40:24 DCO version: 7.0.0-10-generic #10-Ubuntu SMP PREEMPT_DYNAMIC Thu Mar 19 10:24:42 UTC 2026
When I start OpenVPN from the cli directly, there *is* DCO, so something must be going wrong somewhere, it is not clear from the logs though... ``` 2026年03月31日 16:40:24 OpenVPN 2.7.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO] 2026年03月31日 16:40:24 library versions: OpenSSL 3.5.5 27 Jan 2026, LZO 2.10 2026年03月31日 16:40:24 DCO version: 7.0.0-10-generic #10-Ubuntu SMP PREEMPT_DYNAMIC Thu Mar 19 10:24:42 UTC 2026 ```

Probably it will need a bug report in apparmor package: https://bugs.launchpad.net/ubuntu/+source/apparmor?field.searchtext=openvpn

Probably it will need a bug report in apparmor package: https://bugs.launchpad.net/ubuntu/+source/apparmor?field.searchtext=openvpn

This may be related: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2146874

This may be related: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2146874
Author
Owner
Copy link

@FabioPedretti wrote in #21 (comment):

Probably it will need a bug report in apparmor package: https://bugs.launchpad.net/ubuntu/+source/apparmor?field.searchtext=openvpn

Issue for key is already there: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2143810

@FabioPedretti wrote in https://codeberg.org/eduVPN/deploy/issues/21#issuecomment-12479268: > Probably it will need a bug report in apparmor package: https://bugs.launchpad.net/ubuntu/+source/apparmor?field.searchtext=openvpn Issue for key is already there: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2143810
Author
Owner
Copy link

Hmm when you first run OpenVPN from the CLI and then later with NetworkManager it does use DCO. It seems the ovpn kernel module gets only loaded when running from the CLI, but it can be used by NetworkManager once it is loaded...

Hmm when you first run OpenVPN from the CLI and then later with NetworkManager it *does* use DCO. It seems the `ovpn` kernel module gets only loaded when running from the CLI, but it can be used by NetworkManager once it is loaded...
Author
Owner
Copy link

Also tested on Fedora 44 beta, there DCO also doesn't work.

So indeed, I guess we are back here: https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/issues/103

Also tested on Fedora 44 beta, there DCO also doesn't work. So indeed, I guess we are back here: https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/issues/103
Author
Owner
Copy link

This particular issue is only related to the server and that part has been fixed now.

This particular issue is only related to the *server* and that part has been fixed now.
Author
Owner
Copy link

Upstream bug report: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2146980

Upstream bug report: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2146980
Author
Owner
Copy link

Upstream fix suggestion for NetworkManager/OpenVPN for clients in the comments: https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/issues/103

Upstream fix suggestion for NetworkManager/OpenVPN for _clients_ in the comments: https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/issues/103
Author
Owner
Copy link

Blog post on the topic: https://www.tuxed.net/fkooman/blog/openvpn-dco.html

Blog post on the topic: https://www.tuxed.net/fkooman/blog/openvpn-dco.html

@fkooman wrote in #21 (comment):

Blog post on the topic: https://www.tuxed.net/fkooman/blog/openvpn-dco.html

Thanks!
In the meantime Ubuntu fixed at least issues 1 and 2, so you may want to update the blog post.

@fkooman wrote in https://codeberg.org/eduVPN/deploy/issues/21#issuecomment-12508116: > Blog post on the topic: https://www.tuxed.net/fkooman/blog/openvpn-dco.html Thanks! In the meantime Ubuntu fixed at least issues 1 and 2, so you may want to update the blog post.
Author
Owner
Copy link

@FabioPedretti wrote in #21 (comment):

Thanks! In the meantime Ubuntu fixed at least issues 1 and 2, so you may want to update the blog post.

Done!

@FabioPedretti wrote in https://codeberg.org/eduVPN/deploy/issues/21#issuecomment-12943542: > Thanks! In the meantime Ubuntu fixed at least issues 1 and 2, so you may want to update the blog post. Done!
Sign in to join this conversation.
No Branch/Tag specified
v3
wg-only
v4
v2
No results found.
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
eduVPN/deploy#21
Reference in a new issue
eduVPN/deploy
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?