0

Not able to run isc-dhcp-server6, getting error "Can't create PID file /run/dhcp-server6/dhcpd6.pid: Permission denied."

I have added a isc-dhcp-server and configured IPv4 and IPv6 conf files. Once service started, I am getting the service status as "Active/Running" but Clients are not getting IPv6. Able to see this PID Permission denied Error and in linux apparmor shows this DENIED log.

Server Status

root@testlaptop:~# sudo service isc-dhcp-server6 status
● isc-dhcp-server6.service - ISC DHCP IPv6 server
     Loaded: loaded (/usr/lib/systemd/system/isc-dhcp-server6.service; enabled; preset: enabled)
     Active: active (running) since Fri 2025-03-21 15:08:42 GMT; 2s ago
 Invocation: edbff363c3a04991aaf78abe202a1dd0
       Docs: man:dhcpd(8)
   Main PID: 110062 (dhcpd)
      Tasks: 1 (limit: 9035)
     Memory: 2M (peak: 2.3M)
        CPU: 18ms
     CGroup: /system.slice/isc-dhcp-server6.service
             └─110062 dhcpd -user dhcpd -group dhcpd -f -6 -pf /run/dhcp-server6/dhcpd6.pid -cf /etc/dhcp/dhcpd6.conf enx000acd3b1ce9

Mar 21 15:08:42 testlaptop sh[110062]: Wrote 0 NA, 0 TA, 0 PD leases to lease file.
Mar 21 15:08:42 testlaptop dhcpd[110062]: Bound to :547
Mar 21 15:08:42 testlaptop sh[110062]: Bound to :547
Mar 21 15:08:42 testlaptop sh[110062]: Listening on Socket/5/enx000acd3b1ce9/2001:db8:0:1::/64
Mar 21 15:08:42 testlaptop sh[110062]: Sending on   Socket/5/enx000acd3b1ce9/2001:db8:0:1::/64
Mar 21 15:08:42 testlaptop dhcpd[110062]: Listening on Socket/5/enx000acd3b1ce9/2001:db8:0:1::/64
Mar 21 15:08:42 testlaptop sh[110062]: Can't create PID file /run/dhcp-server6/dhcpd6.pid: Permission denied.
Mar 21 15:08:42 testlaptop dhcpd[110062]: Sending on   Socket/5/enx000acd3b1ce9/2001:db8:0:1::/64
Mar 21 15:08:42 testlaptop dhcpd[110062]: Can't create PID file /run/dhcp-server6/dhcpd6.pid: Permission denied.
Mar 21 15:08:42 testlaptop dhcpd[110062]: Server starting service.
root@testlaptop:~#

AppArmor Logs

root@testlaptop:~# dmesg | grep dhcp
[175929.507937] audit: type=1400 audit(1742484091.432:2755): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/dhcpd" pid=70226 comm="apparmor_parser"
[177555.094057] audit: type=1400 audit(1742485717.023:2773): apparmor="DENIED" operation="mknod" class="file" profile="/usr/sbin/dhcpd" name="/run/dhcp-server6/dhcpd6.pid" pid=72807 comm="dhcpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
[177579.913723] audit: type=1400 audit(1742485741.843:2774): apparmor="DENIED" operation="mknod" class="file" profile="/usr/sbin/dhcpd" name="/run/dhcp-server6/dhcpd6.pid" pid=72849 comm="dhcpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
[180178.473613] audit: type=1400 audit(1742488340.414:3028): apparmor="DENIED" operation="mknod" class="file" profile="/usr/sbin/dhcpd" name="/run/dhcp-server6/dhcpd6.pid" pid=74943 comm="dhcpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
[252515.925064] audit: type=1400 audit(1742560678.084:3269): apparmor="DENIED" operation="mknod" class="file" profile="/usr/sbin/dhcpd" name="/run/dhcp-server6/dhcpd6.pid" pid=101985 comm="dhcpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
[252646.179585] audit: type=1400 audit(1742560808.340:3270): apparmor="DENIED" operation="mknod" class="file" profile="/usr/sbin/dhcpd" name="/run/dhcp-server6/dhcpd6.pid" pid=102093 comm="dhcpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
[252771.361342] audit: type=1400 audit(1742560933.523:3271): apparmor="DENIED" operation="mknod" class="file" profile="/usr/sbin/dhcpd" name="/run/dhcp-server6/dhcpd6.pid" pid=102359 comm="dhcpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
[253206.275049] audit: type=1400 audit(1742561368.441:3272): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/sbin/dhcpd" pid=103160 comm="apparmor_parser"
[253304.106016] audit: type=1400 audit(1742561466.272:3273): apparmor="DENIED" operation="mknod" class="file" profile="/usr/sbin/dhcpd" name="/run/dhcp-server6/dhcpd6.pid" pid=103381 comm="dhcpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
[253581.767720] audit: type=1400 audit(1742561743.936:3274): apparmor="DENIED" operation="mknod" class="file" profile="/usr/sbin/dhcpd" name="/run/dhcp-server6/dhcpd6.pid" pid=103990 comm="dhcpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
[253589.422389] audit: type=1400 audit(1742561751.591:3275): apparmor="DENIED" operation="mknod" class="file" profile="/usr/sbin/dhcpd" name="/run/dhcp-server6/dhcpd6.pid" pid=104023 comm="dhcpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
[260897.212216] audit: type=1400 audit(1742569059.410:3279): apparmor="DENIED" operation="mknod" class="file" profile="/usr/sbin/dhcpd" name="/run/dhcp-server6/dhcpd6.pid" pid=107950 comm="dhcpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
[261079.678820] audit: type=1400 audit(1742569241.878:3683): apparmor="DENIED" operation="mknod" class="file" profile="/usr/sbin/dhcpd" name="/run/dhcp-server6/dhcpd6.pid" pid=108639 comm="dhcpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
[261462.472012] audit: type=1400 audit(1742569624.672:3820): apparmor="DENIED" operation="mknod" class="file" profile="/usr/sbin/dhcpd" name="/run/dhcp-server6/dhcpd6.pid" pid=109961 comm="dhcpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
[261559.904001] audit: type=1400 audit(1742569722.104:3821): apparmor="DENIED" operation="mknod" class="file" profile="/usr/sbin/dhcpd" name="/run/dhcp-server6/dhcpd6.pid" pid=110062 comm="dhcpd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
root@testlaptop:~#

I tried few things from https://askubuntu.com/a/1365896/814284 and still not helping. Can someone please help me here. Thank you

Quality_Engineer
  • 1

1 Answers1

0

I hit the same issue on Ubuntu 24.04 and found the PID location in the isc-dhcp-server6.service unit file, /run/dhcp-server6/dhcpd6.pid is inconsistent with the apparmor config in /etc/apparmor.d/usr.sbin.dhcpd.

Note this does not match /run/dhcp-server6/* paths.

  /{,var/}run/{,dhcp-server/}dhcpd{,6}.pid rw,

To work around this I added an additional apparmor config to /etc/apparmor.d/dhcpd.d/pid-patch.conf with these contents and restarted apparmor via sudo systemctl restart apparmor

/{,var/}run/{,dhcp-server6/}dhcpd{,6}.pid rw,
Justin Pinkul
  • 1