/usr/lib/dovecot/dovecot-lda: "Failed name lookup - disconnected path"

Hi,

I'm currently trying to use dovecot in a test scenario, but run into the problem of a strange malfunction of apparmor.

What I do:

installed packages dovecot-core and dovecot-lmtp
(and of course apparmor)

Then I do (as root)

/usr/lib/dovecot/dovecot-lda -d hadmut <<ENDE
Subject: test

blabla
ENDE

which fails. strace shows:

14353 connect(6, {sa_family=AF_LOCAL, sun_path="/var/run/dovecot/config"}, 110) = -1 EACCES (Permission denied)

...

14353 connect(7, {sa_family=AF_LOCAL, sun_path="/var/run/dovecot/auth-userdb"}, 110) = -1 EACCES (Permission denied)

although file permissions are good, unix sockets exist and daemons are listening.

/var/log/kern.log says

Dec 18 01:09:45 monstrum kernel: [34849.052767] audit: type=1400 audit(1482019785.088:143): apparmor="ALLOWED" operation="connect" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/dovecot-lda" name="run/dovecot/config" pid=15664 comm="dovecot-lda" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0
Dec 18 01:09:45 monstrum kernel: [34849.055652] audit: type=1400 audit(1482019785.092:144): apparmor="ALLOWED" operation="open" profile="/usr/lib/dovecot/dovecot-lda" name="/usr/share/dovecot/protocols.d/" pid=15664 comm="doveconf" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Dec 18 01:09:45 monstrum kernel: [34849.065203] audit: type=1400 audit(1482019785.100:145): apparmor="ALLOWED" operation="connect" info="Failed name lookup - disconnected path" error=-13 profile="/usr/lib/dovecot/dovecot-lda" name="run/dovecot/auth-userdb" pid=15664 comm="dovecot-lda" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=134

which strangely says ALLOWED, but error=-13 as well,

and that even if dovecot-lda is in complain mode.

But when I put it into disable mode with

aa-disable /usr/lib/dovecot/dovecot-lda

then things work.

So

- it is definitely apparmor related, since aa-disable turns the problem off,
- it looks like a bug since aa-complain should never block anything,
- an ALLOWED-log should not blog
- there's an error=-13

regards

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: apparmor-profiles 2.10.95-0ubuntu2.5
ProcVersionSignature: Ubuntu 4.4.0-53.74-generic 4.4.30
Uname: Linux 4.4.0-53-generic x86_64
ApportVersion: 2.20.1-0ubuntu2.2
Architecture: amd64
CurrentDesktop: LXDE
Date: Sun Dec 18 01:06:15 2016
PackageArchitecture: all
ProcKernelCmdline: BOOT_IMAGE=/vmlinuz-4.4.0-53-generic root=UUID=3e286927-f1b6-4954-8b0d-7cf23484309f ro rootflags=subvol=@ splash quiet vt.handoff=7
SourcePackage: apparmor
UpgradeStatus: Upgraded to xenial on 2016-04-06 (255 days ago)