Can not create a socket for launching a KIO worker for protocol 'file'

[dougg0k]

Hi,

One of your profiles, possibly kioworker are causing the error on KDE.

CachyOS/distribution#69

Can you provide a fix?

---

I tried disabling the profile with sudo aa-disable /etc/apparmor.d/kioworker but it didnt work, the profile was disabled, but the error are back. So, it might be some other profile.

[roddhjav]

can you provide the full logs that caused the error: https://apparmor.pujol.io/report/

[dougg0k]

~ as 🧙
❯ aa-log -R

                                                                                                                                                                                                                                                                      
~ as 🧙
❯ aa-log -s -R

                                                                                                                                                                                                                                                                      
~ as 🧙
❯ aa-log -R -f 1

                                                                                                                                                                                                                                                                    
~ as 🧙
❯ aa-log -R -f 2

Same with sudo.

[dougg0k]

But I have another way to get logs, and I dont see anything from apparmor when the error happens.

qbittorrent[136896]: edit: editing failed
kde-open[138094]: kf.kio.core: ConnectionServer::listenForRemote failed: "QLocalServer::listen: Name error"
kde-open[138094]: kf.kio.core: KIO Connection server not listening, could not connect
kde-open[138094]: kf.kio.core: couldn't create worker: "Can not create a socket for launching a KIO worker for protocol 'file'."

But the only thing so far that have resolved the issue is a sudo aa-teardown.

---

I also see the audit from apparmor on the logs. But all starts with apparmor="ALLOWED", there is no apparmor="DENIED"

[roddhjav]

Can you share all audit with apparmor="ALLOWED"

[dougg0k]

I did a reboot to clean things up as I was disabling and enabling it before.

But now there are barely any, that's relevant. https://pastebin.com/2ST5KaCi

[dougg0k]

I also confirm that by removing apparmor.d-git, are enough to fix the issue. No need to aa-teardown.

[dougg0k]

What is common in between apps that trigger the error seems to be kde-open.

[dougg0k]

There is this specific audit that keeps spamming regardless if I trigger the error or not, that are from apparmor when checking through sudo dmesg -H -T.

audit: type=1400 audit(1734707074.958:612142): apparmor="ALLOWED" operation="open" class="file" profile="xwayland" name="/" pid=3066 comm="Xwayland" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

And it's the same msg log repeated.

It's spammed a lot, all the time, I dont know why. Who knows if it's retrying in attempt to make the socket connection. Because there are no files being open and it is not very specific.

---

Though when in X11, this is the spammy message, that continuously repeat, even without triggering the error. audit(1734986985.374:203852): apparmor="ALLOWED" operation="open" class="file" profile="kwin_x11" name="/" pid=4364 comm="kwin_x11" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

[Cherkah]

when apparmor.d is enabled on my kde plasma i've also this issuewhen i want to access the trash via the applet in my dockPannel.

For this cas this is what i get:

Error KIO client:
Unable to create an input/output module. Unable to create a socket to launch an input/output module for protocol 'trash'

find bellow the apparmor.d log

ALLOWED xwayland open / comm=Xwayland requested_mask=r denied_mask=r
ALLOWED polkit-kde-authentication-agent open owner @{user_config_dirs}/plasmarc comm=polkit-kde-auth requested_mask=r denied_mask=r
ALLOWED polkit-kde-authentication-agent open / comm=polkit-kde-auth requested_mask=r denied_mask=r
ALLOWED plasmashell open owner /tmp/..com.vivaldi.Vivaldi.ZcNAnT comm=QQuickPixmapRea requested_mask=r denied_mask=r
ALLOWED systemd-journald open @{run}/systemd/units/log-extra-fields:run-p16853-i17153.service comm=systemd-journal requested_mask=r denied_mask=r
ALLOWED systemd-user-runtime-dir getattr  info="Failed name lookup - disconnected path" comm=systemd-user-ru requested_mask=r denied_mask=r error=-13
ALLOWED kde-powerdevil open owner @{PROC}/@{pid}/mountinfo comm=org_kde_powerde requested_mask=r denied_mask=r
ALLOWED systemd-generator-user-environment getattr  info="Failed name lookup - disconnected path" comm=30-systemd-envi requested_mask=r denied_mask=r error=-13
ALLOWED systemd-generator-user-autostart getattr  info="Failed name lookup - disconnected path" comm=systemd-xdg-aut requested_mask=r denied_mask=r error=-13

in other cases I can't make simple system scripts (.sh / .py) work to improve the use of some applications.

and the solution of using the aa-logprof command is still not functional (apparmor bug)

hoping that a temporary solution is implemented in the apparmor.d config while waiting for the apparmor team to deliver a functional version 4

[dougg0k]

Can you provide a fix @roddhjav or is there anything else needed?

[dougg0k]

Can you publish? Last release was 10-2024 https://aur.archlinux.org/packages/apparmor.d-git

[roddhjav]

This is a -git package, it is always up-to-date. Just install it again, it will build from the main branch.

Edit: reopening as I am not 100% sure this the issue has been fully fixed.

[dougg0k]

It's not fixed.

[roddhjav]

Again, if you don't provide logs, I can't help you.

[dougg0k]

I already did before. Was that used?

[dougg0k]

In the logs, there is only this in between the times it failed, but there is many other of the same, outside the time it failed.

[32759.931843] audit: type=1400 audit(1736461919.036:3347311): apparmor="ALLOWED" operation="open" class="file" profile="kwin_x11" name="/" pid=36508 comm="kwin_x11" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

jan 09 19:31:05 desktop-pc kde-open[144683]: kf.kio.core: ConnectionServer::listenForRemote failed: "QLocalServer::listen: Name error"
jan 09 19:31:05 desktop-pc kde-open[144683]: kf.kio.core: KIO Connection server not listening, could not connect
jan 09 19:31:05 desktop-pc kde-open[144683]: kf.kio.core: couldn't create worker: "Can not create a socket for launching a KIO worker for protocol 'file'."
jan 09 19:31:05 desktop-pc kde-open[144683]: Unable to create KIO worker. Can not create a socket for launching a KIO worker for protocol 'file'.

There is nothing more to provide.

[Cherkah]

@roddhjav that are logs for the child-open-any profile:

apparmor="DENIED" operation="open" class="file" profile="child-open-any" name="/usr/share/glvnd/egl_vendor.d/"  comm="kde-open" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 FSUID="USER" OUID="root"
apparmor="DENIED" operation="open" class="file" profile="child-open-any" name="/home/USER/.config/breezerc"  comm="kde-open" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000 FSUID="USER" OUID="USER"
apparmor="DENIED" operation="open" class="file" profile="child-open-any" name="/home/USER/.cache/ksycoca6_fr_Q9NO9QOLXVMU_sw+qnb72vt+aK8="  comm="kde-open" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000 FSUID="USER"OUID="USER"
apparmor="DENIED" operation="mknod" class="file" profile="child-open-any" name="/home/USER/.cache/ksycoca6_fr_Q9NO9QOLXVMU_sw+qnb72vt+aK8=.lock"  comm="kde-open" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000 FSUID="USER" OUID="USER"
apparmor="DENIED" operation="open" class="file" profile="child-open-any" name="/run/user/1000/#250"  comm="kde-open" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=1000 FSUID="USER" OUID="USER"
apparmor="DENIED" operation="open" class="file" profile="child-open-any" name="/etc/pulse/client.conf"  comm="kde-open" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 FSUID="USER" OUID="root"
apparmor="DENIED" operation="open" class="file" profile="child-open-any" name="/dev/shm/"  comm="kde-open" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 FSUID="USER" OUID="root"
apparmor="DENIED" operation="open" class="file" profile="child-open-any" name="/run/user/1000/pulse/"  comm="kde-open" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000 FSUID="USER" OUID="USER"
apparmor="DENIED" operation="rmdir" class="file" profile="child-open-any" name="/run/user/1000/pulse/"  comm="kde-open" requested_mask="d" denied_mask="d" fsuid=1000 ouid=1000 FSUID="USER" OUID="USER"
apparmor="DENIED" operation="open" class="file" profile="child-open-any" name="/proc/4598/fd/"  comm="kde-open" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000 FSUID="USER" OUID="USER"
apparmor="DENIED" operation="open" class="file" profile="child-open-any" name="/etc/machine-id"  comm="kde-open" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 FSUID="USER" OUID="root"
apparmor="DENIED" operation="mknod" class="file" profile="child-open-any" name="/home/USER/.cache/event-sound-cache.tdb.LEGION.x86_64-pc-linux-gnu"  comm="kde-open" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000 FSUID="USER" OUID="USER"
apparmor="DENIED" operation="open" class="file" profile="child-open-any" name="/usr/share/sounds/ocean/index.theme"comm="kde-open" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 FSUID="USER" OUID="root"
apparmor="ALLOWED" operation="open" class="file" profile="plasmashell" name="/home/USER/.local/share/plasma_notes/d01296bc-ed2f-49da-88d3-79d8950fa4"  comm="plasmashell" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000FSUID="USER" OUID="USER"
apparmor="ALLOWED" operation="truncate" class="file" profile="plasmashell" name="/home/USER/.local/share/plasma_notes/d01296bc-ed2f-49da-88d3-79d8950fa4"  comm="plasmashell" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000 FSUID="USER" OUID="USER"

regards