Here's the audit output: In Enforcing mode: [116298.210537] audit: type=1400 audit(1755186236.003:693): apparmor="STATUS" operation="profile_load" profile="unconfined" name="unbound" pid=913125 comm="apparmor_parser" [116301.019725] audit: type=1400 audit(1755186238.812:694): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="unbound" pid=913233 comm="unbound" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none [116301.019730] audit: type=1400 audit(1755186238.812:695): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="unbound" pid=913233 comm="unbound" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none [116301.020653] audit: type=1400 audit(1755186238.813:696): apparmor="DENIED" operation="capable" class="cap" profile="unbound" pid=913233 comm="unbound" capability=12 capname="net_admin" [116301.021313] audit: type=1400 audit(1755186238.814:697): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="unbound" pid=913233 comm="unbound" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none [116301.340243] audit: type=1400 audit(1755186239.133:698): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="unbound" pid=913277 comm="unbound" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none [116301.340248] audit: type=1400 audit(1755186239.133:699): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="unbound" pid=913277 comm="unbound" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none [116301.341241] audit: type=1400 audit(1755186239.134:700): apparmor="DENIED" operation="capable" class="cap" profile="unbound" pid=913277 comm="unbound" capability=12 capname="net_admin" [116301.341899] audit: type=1400 audit(1755186239.134:701): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="unbound" pid=913277 comm="unbound" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none [116301.637948] audit: type=1400 audit(1755186239.430:702): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="unbound" pid=913328 comm="unbound" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
In Complain mode: [116330.288320] audit: type=1400 audit(1755186268.082:714): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="unbound" pid=913713 comm="apparmor_parser" [116331.912069] audit: type=1400 audit(1755186269.706:715): apparmor="ALLOWED" operation="create" class="net" info="failed protocol match" error=-13 profile="unbound" pid=913729 comm="unbound" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none [116331.912084] audit: type=1400 audit(1755186269.706:716): apparmor="ALLOWED" operation="create" class="net" info="failed protocol match" error=-13 profile="unbound" pid=913729 comm="unbound" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none [116331.913004] audit: type=1400 audit(1755186269.707:717): apparmor="ALLOWED" operation="capable" class="cap" profile="unbound" pid=913729 comm="unbound" capability=12 capname="net_admin" [116331.913644] audit: type=1400 audit(1755186269.707:718): apparmor="ALLOWED" operation="create" class="net" info="failed protocol match" error=-13 profile="unbound" pid=913729 comm="unbound" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none [116331.914692] audit: type=1400 audit(1755186269.708:719): apparmor="ALLOWED" operation="create" class="net" info="failed protocol match" error=-13 profile="unbound" pid=913729 comm="unbound" family="unix" sock_type="dgram" protocol=0 requested="create" denied="create" addr=none [116331.914716] audit: type=1400 audit(1755186269.708:720): apparmor="ALLOWED" operation="create" class="net" info="failed protocol match" error=-13 profile="unbound" pid=913729 comm="unbound" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none [116331.914731] audit: type=1400 audit(1755186269.708:721): apparmor="ALLOWED" operation="create" class="net" info="failed protocol match" error=-13 profile="unbound" pid=913729 comm="unbound" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none [116331.915012] audit: type=1400 audit(1755186269.709:722): apparmor="ALLOWED" operation="create" class="net" info="failed protocol match" error=-13 profile="unbound" pid=913729 comm="unbound" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none [116331.915023] audit: type=1400 audit(1755186269.709:723): apparmor="ALLOWED" operation="connect" class="file" profile="unbound" name="/run/samba/winbindd/pipe" pid=913729 comm="unbound" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0 On Thu, Aug 14, 2025 at 12:36 PM Michael Tokarev <[email protected]> wrote: > > On 13.08.2025 12:00, Brian Turek wrote: > > Package: unbound > > Version: 1.22.0-2 > > Severity: important > > > > Dear Maintainer, > > > > * What led up to the situation? > > I recently just upgraded my Proxmox host from Debian 12 to 13 as well > > as Proxmox 8 to 9. Upon reboot, my existing/working installation of unbound > > did not start > > * What exactly did you do (or not do) that was effective (or > > ineffective)? > > After troubleshooting, I determined something in the stock AppArmor > > profile was blocking unbound from starting. Putting the unbound AppArmor > > profile into complain mode yielded ambiguous socket denial errors. > > Disabling the AppArmor profile allowed unbound to start correctly. I also > > purged my existing unbound install (reverting to stock configs) and it too > > would not start > > What does it deny, exactly? > > Thanks, > > /mjt
