The dovecot profiles in the sec-policy/apparmor-profiles-3.0.1 assumes that there is a directory /usr/lib/dovecot with a number of binaries, but in Gentoo's dovecot ebuild all those failes are placed in /usr/libexec/dovecot When you start dovecot you will encounter the following error in /var/log/audit.log: Sep 15 05:11:02 server kernel: [ 1665.593023] audit: type=1400 audit(1631682662.261:278): apparmor="DENIED" operation="exec" profile="dovecot" name="/usr/bin/doveadm" pid=5288 comm="dovecot" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 as the doveadm ain't configured in the dovecot profiles. Adding it manually to the dovecot profile with ux you will then get issues with all the other exec that are assumed to be in /usr/lib/dovecot but are in /usr/libexec/dovecot for example: Sep 19 11:22:08 server kernel: [369518.485303] audit: type=1400 audit(1632050528.564:705): apparmor="DENIED" operation="exec" profile="dovecot" name="/usr/libexec/dovecot/managesieve" pid=8493 comm="doveconf" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 Sep 19 11:22:08 server kernel: [369518.503613] audit: type=1400 audit(1632050528.584:706): apparmor="DENIED" operation="exec" profile="dovecot" name="/usr/libexec/dovecot/managesieve" pid=8497 comm="doveconf" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 Modifying the profiles to use the path /usr/libexec/dovecot and giving doveadm exec permission (and restarted apparmor) things works as expected. Reproducible: Always Steps to Reproduce: (assuming that apparmor already build into kernel and activated) 1. emerge sec-policy/apparmor-profiles net-mail/dovecot 2. /etc/init.d/apparmor start 3. /etc/init.d/dovecot start Actual Results: Sep 15 05:11:02 server kernel: [ 1665.593023] audit: type=1400 audit(1631682662.261:278): apparmor="DENIED" operation="exec" profile="dovecot" name="/usr/bin/doveadm" pid=5288 comm="dovecot" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 Expected Results: Expected that dovecot would start without faults. Sure you can add rules in the local/ files, but IMHO this shouldn't be done when you have a default install of an application. My dovecot has the following USE flags: bzip2 caps ipv6 lucene managesieve mysql pam rpc sieve solr zlib lua5-1 My apparmor-profiles do not have any USE flags set.
Upstream PR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1080
