Re: [chrony-users] chronyc serverstats => 501 not autorized

[Gerd Hoerst <gerd@xxxxxxxxxx>]

Hi !

This is the syslog failure...

2025-11-20T18:36:00.162723+01:00 capricorn kernel: audit: type=1400 
audit(1763660160.160:1399): apparmor="DENIED" operation="se              
                              ndmsg" class="file" 
profile="/usr/sbin/chronyd" 
name="/run/chrony/chronyc.137314/kZXsY1DaPSMkEEhv/sock" pid=137314 
comm="chrony                                            c" 
requested_mask="r" denied_mask="r" fsuid=138 ouid=0

I do not understand why my apparmor is running... its nrmally the first 
thing i disable , when i hav a problem

Ciao Gerd

Am 20.11.2025 um 10:25 schrieb Miroslav Lichvar:
> On Thu, Nov 20, 2025 at 10:03:45AM +0100, Gerd Hoerst wrote:
> > Hi !
> >
> > OK you are right... iwas kind of confused because in apparmor is only a
> > profile for /usr/sbin/chronyd
> > So do i need a profile for /usr/bin/chronyc with same settings as for
> > chronyd ?
> I'm not very familiar. First, I'd try to change the following line in
> the chrony policy:
>
> @{run}/chrony/{,*} rw,
>
> to
>
> @{run}/chrony/{,**} rw,
>
> (extra asterisk)

--
To unsubscribe email chrony-users-request@xxxxxxxxxxxxxxxxxxxx 
with "unsubscribe" in the subject.
For help email chrony-users-request@xxxxxxxxxxxxxxxxxxxx 
with "help" in the subject.
Trouble?  Email listmaster@xxxxxxxxxxxxxxxxxxxx.