Sandbox docs: Suggestion to install apparmor can break samba

What is the type of issue?

_No response_

What is the issue?

Not sure this is even the right place for this, but today I did what I was asked to do for Ubuntu 24.04 (https://developers.openai.com/codex/concepts/sandboxing):

> sudo apt install apparmor-profiles apparmor-utils

If you are using samba, this might just silently break your setup. In my case, after this, even local lookups failed:

wbinfo -s S-1-5-32-544
failed to call wbcLookupSid: WBC_ERR_DOMAIN_NOT_FOUND
Could not lookup sid S-1-5-32-544

(usually that should return BUILTIN\Administrators).

That's because apparmor blocked it:

May 22 11:14:16 kernel: audit: type=1400 audit(1779448456.840:851): apparmor="DENIED" operation="file_receive" class="file" profile="samba-rpcd" name="/run/samba/ncalrpc/np/samr" pid=11555 comm="rpcd_lsad" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0

and in the winbind logs I saw things like

[2026/05/22 10:58:58.918855,  5, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:677(new_connection)
  Accepted client socket 24
[2026/05/22 10:58:58.918934, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:525(process_request_send)
  process_request_send: process_request: request fn INTERFACE_VERSION
[2026/05/22 10:58:58.918946,  3, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd_misc.c:355(winbindd_interface_version)
  winbindd_interface_version: [wbinfo (6566)]: request interface version (version = 32)
[2026/05/22 10:58:58.918971, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:609(process_request_written)
  process_request_written: [wbinfo(6566):INTERFACE_VERSION]: delivered response to client
[2026/05/22 10:58:58.919000,  3, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:497(process_request_send)
  process_request_send: [wbinfo (6566)] Handling async request: LOOKUPSID
[2026/05/22 10:58:58.919010,  3, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd_lookupsid.c:51(winbindd_lookupsid_send)
  lookupsid S-1-5-32-544
[2026/05/22 10:58:58.919023,  5, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send)
  WB command lookupsid start.
[2026/05/22 10:58:58.919032, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid)
  find_lookup_domain_from_sid: SID [S-1-5-32-544]
[2026/05/22 10:58:58.919047, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/wb_lookupsid.c:61(wb_lookupsid_send)
  Looking up SID S-1-5-32-544 in domain BUILTIN.
[2026/05/22 10:58:58.949377,  5, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv)
  WB command lookupsid end.
[2026/05/22 10:58:58.949415,  1, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/wb_lookupsid.c:102(wb_lookupsid_recv)
  Failed with NT_STATUS_CONNECTION_DISCONNECTED.
[2026/05/22 10:58:58.949433,  5, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd_lookupsid.c:94(winbindd_lookupsid_recv)
  Could not lookup sid S-1-5-32-544: NT_STATUS_CONNECTION_DISCONNECTED
[2026/05/22 10:58:58.949449,  3, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:564(process_request_done)
  process_request_done: [wbinfo(6566):LOOKUPSID]: NT_STATUS_CONNECTION_DISCONNECTED
[2026/05/22 10:58:58.949484, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:609(process_request_written)
  process_request_written: [wbinfo(6566):LOOKUPSID]: delivered response to client
[2026/05/22 10:58:58.949549,  6, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:725(winbind_client_request_read)
  closing socket 24, client exited

Took me way longer than I'd like to admit to track that down.

Where did you find it?

https://developers.openai.com/codex/concepts/sandboxing)