Why does apparmor kill dhclient?

Solution 1:

AppArmor is NOT killing dhclient, it is only denying access to the file /proc/1878/task/1881/comm, and logging that the violation happened. If AppArmor had killed dhclient the message would have had apparmor="KILLED" instead of apparmor="DENIED".

If dhclient is exiting after the denial it would be because it is handling the denial as a fatal error.

As to why dhclient is asking for access to that file, it appears to be wanting to change the comm of some of its threads. You can find more info on that file with man 5 proc.

Adding the suggested rule should generally be safe.

Solution 2:

There is a bug reported for this: https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/1918410 and fix in AppArmor https://gitlab.com/apparmor/apparmor/-/merge_requests/730 with a good string:

owner @{PROC}/@{pid}/task/[0-9]*/comm rw,

To fix this, edit the /etc/apparmor.d/sbin.dhclient file with a text editor and add the above line to it.