{"id":31,"date":"2022-02-25T19:03:45","date_gmt":"2022-02-26T02:03:45","guid":{"rendered":"http:\/\/www.chuonthis.com\/tips\/2022\/02\/25\/suse-linux-ping-socket-permission-denied\/"},"modified":"2022-02-28T17:40:44","modified_gmt":"2022-03-01T00:40:44","slug":"suse-linux-ping-socket-permission-denied","status":"publish","type":"post","link":"https:\/\/chuonthis.com\/tips\/2022\/02\/25\/suse-linux-ping-socket-permission-denied\/","title":{"rendered":"SUSE Linux – ping socket: Permission denied"},"content":{"rendered":"

Performed an in-place upgrade of a SUSE Linux Enterprise Server machine from SUSE 10 to SUSE 11. Afterwards, I noticed that I couldn’t use the ping command. I get the message socket: Permission denied<\/code>. Checked the permissions on the ping executable and it looked okay. Google didn’t seem to be coming up with anything useful, but I kept glancing over this Chinese blog post<\/a>. I finally decided to run it through Google translate<\/a> and saw that it suggested that AppArmor was the culprit. Sure enough, ran rcapparmor stop<\/code> and I could ping again.<\/p>\n

Checking in \/var\/log\/audit\/audit.log<\/b>, I saw entries like this:
\ntype=AVC msg=audit(1645839789.983:367): apparmor=\"DENIED\" operation=\"create\" profile=\"\/{usr\/,}bin\/ping\" pid=4499 comm=\"ping\" family=\"inet\" sock_type=\"dgram\" protocol=0<\/code><\/p>\n

That got me digging into files in \/etc\/apparmor.d<\/b>. The bin.ping<\/b> file matched with one from a working system so I went to dig into the files that were being included at the top of the file:<\/p>\n

#include <abstractions\/base>
\n#include <abstractions\/consoles>
\n#include <abstractions\/nameservice><\/code><\/p>\n

Doing a comparison of these files with a working system, I found that the non-working system had some lines missing in the \/etc\/apparmor.d\/abstractions\/nameservice<\/b> file. I added the lines below from a working file to the bottom of my non-working file, ran rcapparmor restart<\/code>, and success! Pings are working again.<\/p>\n

# TCP\/UDP network access
\nnetwork inet stream,
\nnetwork inet6 stream,
\nnetwork inet dgram,
\nnetwork inet6 dgram,<\/code><\/p>\n

Another possible solution may be to run the aa-complain<\/b>, aa-logprof<\/b>, and aa-enforce<\/b> commands as described in this SUSE support doc<\/a>. I tried that and it didn’t seem to do anything.<\/p>\n","protected":false},"excerpt":{"rendered":"

Performed an in-place upgrade of a SUSE Linux Enterprise Server machine from SUSE 10 to SUSE 11. Afterwards, I noticed that I couldn’t use the ping command. I get the message socket: Permission denied. Checked the permissions on the ping executable and it looked okay. Google didn’t seem to be coming up with anything useful, but I kept glancing over… Continue reading SUSE Linux – ping socket: Permission denied<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-31","post","type-post","status-publish","format-standard","hentry","category-computers","entry"],"_links":{"self":[{"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/posts\/31","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/comments?post=31"}],"version-history":[{"count":0,"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/posts\/31\/revisions"}],"wp:attachment":[{"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/media?parent=31"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/categories?post=31"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/chuonthis.com\/tips\/wp-json\/wp\/v2\/tags?post=31"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}