Public bug reported: When trying to use wg-quick inside an Incus container to connect to a Mullvad Wireguard VPN I was getting segfaults from wg-quick. The problem only happened after I upgraded the container from Ubuntu 24.04 to 26.04.
I set AppArmor to complain mode to get logs that show what it's trying to block. 2026-10-26T23:33:20.707235+00:00 vpncntr kernel: audit: type=1400 audit(1793057600.705:23744): apparmor="STATUS" operation="profile_replace" label="incus-vpncntr_</var/lib/incus>//&:incus-vpncntr_<var-lib-incus>:unconfined" name="wg-quick" pid=2178747 comm="apparmor_parser" 2026-10-26T23:33:20.710221+00:00 vpncntr kernel: audit: type=1400 audit(1793057600.708:23746): apparmor="STATUS" operation="profile_replace" label="incus-vpncntr_</var/lib/incus>//&:incus-vpncntr_<var-lib-incus>:unconfined" name="wg-quick//nft" pid=2178747 comm="apparmor_parser" 2026-10-26T23:33:26.266468+00:00 vpncntr systemd[1]: Starting [email protected] - WireGuard via wg-quick(8) for se/got/wg/003... 2026-10-26T23:33:26.279210+00:00 vpncntr kernel: audit: type=1400 audit(1793057606.277:23748): apparmor="ALLOWED" operation="file_mmap" class="file" namespace="root//incus-vpncntr_<var-lib-incus>" profile="wg-quick" name="/usr/bin/bash" pid=2178768 comm="wg-quick" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 2026-10-26T23:33:26.280188+00:00 vpncntr kernel: audit: type=1400 audit(1793057606.278:23749): apparmor="ALLOWED" operation="open" class="file" namespace="root//incus-vpncntr_<var-lib-incus>" profile="wg-quick" name="/etc/nsswitch.conf" pid=2178768 comm="wg-quick" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 2026-10-26T23:33:26.280192+00:00 vpncntr kernel: audit: type=1400 audit(1793057606.278:23750): apparmor="ALLOWED" operation="file_perm" class="file" namespace="root//incus-vpncntr_<var-lib-incus>" profile="wg-quick" name="/etc/nsswitch.conf" pid=2178768 comm="wg-quick" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 2026-10-26T23:33:26.280193+00:00 vpncntr kernel: audit: type=1400 audit(1793057606.278:23751): apparmor="ALLOWED" operation="file_perm" class="file" namespace="root//incus-vpncntr_<var-lib-incus>" profile="wg-quick" name="/etc/nsswitch.conf" pid=2178768 comm="wg-quick" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 2026-10-26T23:33:26.280202+00:00 vpncntr kernel: audit: type=1400 audit(1793057606.278:23752): apparmor="ALLOWED" operation="open" class="file" namespace="root//incus-vpncntr_<var-lib-incus>" profile="wg-quick" name="/etc/passwd" pid=2178768 comm="wg-quick" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 2026-10-26T23:33:26.280203+00:00 vpncntr kernel: audit: type=1400 audit(1793057606.278:23753): apparmor="ALLOWED" operation="file_perm" class="file" namespace="root//incus-vpncntr_<var-lib-incus>" profile="wg-quick" name="/etc/passwd" pid=2178768 comm="wg-quick" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 2026-10-26T23:33:26.305419+00:00 vpncntr wg-quick[2483]: [#] ip link add dev se-got-wg-003 type wireguard 2026-10-26T23:33:26.307654+00:00 vpncntr wg-quick[2483]: [#] wg setconf se-got-wg-003 /dev/fd/63 2026-10-26T23:33:26.307875+00:00 vpncntr NetworkManager[711]: <info> [1793057606.3076] manager: (se-got-wg-003): new WireGuard device (/org/freedesktop/NetworkManager/Devices/6) 2026-10-26T23:33:26.309837+00:00 vpncntr wg-quick[2483]: [#] ip -4 address add 10.65.209.177/32 dev se-got-wg-003 2026-10-26T23:33:26.312626+00:00 vpncntr wg-quick[2483]: [#] ip -6 address add fc00:bbbb:bbbb:bb01::2:d1b0/128 dev se-got-wg-003 2026-10-26T23:33:26.321722+00:00 vpncntr wg-quick[2483]: [#] ip link set mtu 1420 up dev se-got-wg-003 2026-10-26T23:33:26.323816+00:00 vpncntr systemd-networkd[695]: se-got-wg-003: Link UP 2026-10-26T23:33:26.323937+00:00 vpncntr systemd-networkd[695]: se-got-wg-003: Gained carrier 2026-10-26T23:33:26.328218+00:00 vpncntr kernel: audit: type=1400 audit(1793057606.326:23755): apparmor="ALLOWED" operation="file_perm" class="file" namespace="root//incus-vpncntr_<var-lib-incus>" profile="wg-quick" name="/proc/2502/cgroup" pid=2178790 comm="sort" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 2026-10-26T23:33:26.328229+00:00 vpncntr kernel: audit: type=1400 audit(1793057606.326:23757): apparmor="ALLOWED" operation="open" class="file" namespace="root//incus-vpncntr_<var-lib-incus>" profile="wg-quick" name="/sys/fs/cgroup/system.slice/system-wg\x2dquick.slice/cpu.max" pid=2178790 comm="sort" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: apparmor 5.0.2-0ubuntu1~26.04.1 ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 Uname: Linux 7.0.0-38-generic x86_64 ApparmorStatusOutput: Error: command ['pkexec', '/usr/sbin/apparmor_status'] failed with exit code 127: Error registering local authentication agent: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: An authentication agent already exists for the given subject ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: unknown CurrentDesktop: KDE Date: Tue Oct 27 10:59:35 2026 InstallationDate: Installed on 2024-12-16 (680 days ago) InstallationMedia: Ubuntu-Server 24.04.1 LTS "Noble Numbat" - Release amd64 (20240827) ProcKernelCmdline: BOOT_IMAGE=/vmlinuz-7.0.0-38-generic root=/dev/mapper/MainVG-root ro systemd.unified_cgroup_hierarchy=0 quiet nosplash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: apparmor UpgradeStatus: Upgraded to resolute on 2026-10-26 (1 days ago) ** Affects: apparmor (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug resolute -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172269 Title: Default AppArmor profile for wg-quick in Ubuntu 26.04 causes segfaults To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2172269/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
