Performed an in-place upgrade of a SUSE Linux Enterprise Server machine from SUSE 10 to SUSE 11. Afterwards, I noticed that I couldn’t use the ping command. I get the message socket: Permission denied. Checked the permissions on the ping executable and it looked okay. Google didn’t seem to be coming up with anything useful, but I kept glancing over this Chinese blog post. I finally decided to run it through Google translate and saw that it suggested that AppArmor was the culprit. Sure enough, ran rcapparmor stop and I could ping again.
Checking in /var/log/audit/audit.log, I saw entries like this:
type=AVC msg=audit(1645839789.983:367): apparmor="DENIED" operation="create" profile="/{usr/,}bin/ping" pid=4499 comm="ping" family="inet" sock_type="dgram" protocol=0
That got me digging into files in /etc/apparmor.d. The bin.ping file matched with one from a working system so I went to dig into the files that were being included at the top of the file:
#include <abstractions/base>
#include <abstractions/consoles>
#include <abstractions/nameservice>
Doing a comparison of these files with a working system, I found that the non-working system had some lines missing in the /etc/apparmor.d/abstractions/nameservice file. I added the lines below from a working file to the bottom of my non-working file, ran rcapparmor restart, and success! Pings are working again.
# TCP/UDP network access
network inet stream,
network inet6 stream,
network inet dgram,
network inet6 dgram,
Another possible solution may be to run the aa-complain, aa-logprof, and aa-enforce commands as described in this SUSE support doc. I tried that and it didn’t seem to do anything.
