The apparmor is disable in bink CI because there is some bugs for passt, without the aa-teardow passt was denied to access /proc/sys/net/ipv4/ip_local_port_range.
In the audit we could see:
ubuntu@ubuntu:~/bink$ sudo journalctl -k | grep passt
Aug 17 07:33:20 ubuntu kernel: audit: type=1400 audit(1786952000.986:232): apparmor="STATUS" operation="profile_load" profile="unconfined" name="passt" pid=2381 comm="apparmor_parser"
Aug 17 07:41:36 ubuntu kernel: audit: type=1400 audit(1786952496.076:233): apparmor="DENIED" operation="open" class="file" profile="passt" name="/proc/sys/net/ipv4/ip_local_port_range" pid=11950 comm="passt.avx2" requested_mask="r" denied_mask="r" fsuid=100106 ouid=1000
Aug 17 07:41:36 ubuntu kernel: audit: type=1400 audit(1786952496.076:234): apparmor="DENIED" operation="mknod" class="file" profile="passt" name="/run/libvirt/qemu/passt/1-node1-net0.socket" pid=11950 comm="passt.avx2" requested_mask="c" denied_mask="c" fsuid=100106 ouid=100106
The apparmor is disable in bink CI because there is some bugs for passt, without the
aa-teardowpasst was denied to access/proc/sys/net/ipv4/ip_local_port_range.In the audit we could see: