Issue Station
Sign In
Tools hereToolbox

codex - 💡(How to fix) Fix Sandbox docs: Suggestion to install apparmor can break samba

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Root Cause

That's because apparmor blocked it:

Code Example

> sudo apt install apparmor-profiles apparmor-utils

---

wbinfo -s S-1-5-32-544
failed to call wbcLookupSid: WBC_ERR_DOMAIN_NOT_FOUND
Could not lookup sid S-1-5-32-544

---

May 22 11:14:16 kernel: audit: type=1400 audit(1779448456.840:851): apparmor="DENIED" operation="file_receive" class="file" profile="samba-rpcd" name="/run/samba/ncalrpc/np/samr" pid=11555 comm="rpcd_lsad" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0

---

[2026/05/22 10:58:58.918855,  5, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:677(new_connection)
  Accepted client socket 24
[2026/05/22 10:58:58.918934, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:525(process_request_send)
  process_request_send: process_request: request fn INTERFACE_VERSION
[2026/05/22 10:58:58.918946,  3, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd_misc.c:355(winbindd_interface_version)
  winbindd_interface_version: [wbinfo (6566)]: request interface version (version = 32)
[2026/05/22 10:58:58.918971, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:609(process_request_written)
  process_request_written: [wbinfo(6566):INTERFACE_VERSION]: delivered response to client
[2026/05/22 10:58:58.919000,  3, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:497(process_request_send)
  process_request_send: [wbinfo (6566)] Handling async request: LOOKUPSID
[2026/05/22 10:58:58.919010,  3, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd_lookupsid.c:51(winbindd_lookupsid_send)
  lookupsid S-1-5-32-544
[2026/05/22 10:58:58.919023,  5, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send)
  WB command lookupsid start.
[2026/05/22 10:58:58.919032, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid)
  find_lookup_domain_from_sid: SID [S-1-5-32-544]
[2026/05/22 10:58:58.919047, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/wb_lookupsid.c:61(wb_lookupsid_send)
  Looking up SID S-1-5-32-544 in domain BUILTIN.
[2026/05/22 10:58:58.949377,  5, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv)
  WB command lookupsid end.
[2026/05/22 10:58:58.949415,  1, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/wb_lookupsid.c:102(wb_lookupsid_recv)
  Failed with NT_STATUS_CONNECTION_DISCONNECTED.
[2026/05/22 10:58:58.949433,  5, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd_lookupsid.c:94(winbindd_lookupsid_recv)
  Could not lookup sid S-1-5-32-544: NT_STATUS_CONNECTION_DISCONNECTED
[2026/05/22 10:58:58.949449,  3, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:564(process_request_done)
  process_request_done: [wbinfo(6566):LOOKUPSID]: NT_STATUS_CONNECTION_DISCONNECTED
[2026/05/22 10:58:58.949484, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:609(process_request_written)
  process_request_written: [wbinfo(6566):LOOKUPSID]: delivered response to client
[2026/05/22 10:58:58.949549,  6, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:725(winbind_client_request_read)
  closing socket 24, client exited
RAW_BUFFERClick to expand / collapse

What is the type of issue?

No response

What is the issue?

Not sure this is even the right place for this, but today I did what I was asked to do for Ubuntu 24.04 (https://developers.openai.com/codex/concepts/sandboxing):

> sudo apt install apparmor-profiles apparmor-utils

If you are using samba, this might just silently break your setup. In my case, after this, even local lookups failed:

wbinfo -s S-1-5-32-544
failed to call wbcLookupSid: WBC_ERR_DOMAIN_NOT_FOUND
Could not lookup sid S-1-5-32-544

(usually that should return BUILTIN\Administrators).

That's because apparmor blocked it:

May 22 11:14:16 kernel: audit: type=1400 audit(1779448456.840:851): apparmor="DENIED" operation="file_receive" class="file" profile="samba-rpcd" name="/run/samba/ncalrpc/np/samr" pid=11555 comm="rpcd_lsad" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0

and in the winbind logs I saw things like

[2026/05/22 10:58:58.918855,  5, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:677(new_connection)
  Accepted client socket 24
[2026/05/22 10:58:58.918934, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:525(process_request_send)
  process_request_send: process_request: request fn INTERFACE_VERSION
[2026/05/22 10:58:58.918946,  3, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd_misc.c:355(winbindd_interface_version)
  winbindd_interface_version: [wbinfo (6566)]: request interface version (version = 32)
[2026/05/22 10:58:58.918971, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:609(process_request_written)
  process_request_written: [wbinfo(6566):INTERFACE_VERSION]: delivered response to client
[2026/05/22 10:58:58.919000,  3, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:497(process_request_send)
  process_request_send: [wbinfo (6566)] Handling async request: LOOKUPSID
[2026/05/22 10:58:58.919010,  3, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd_lookupsid.c:51(winbindd_lookupsid_send)
  lookupsid S-1-5-32-544
[2026/05/22 10:58:58.919023,  5, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send)
  WB command lookupsid start.
[2026/05/22 10:58:58.919032, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid)
  find_lookup_domain_from_sid: SID [S-1-5-32-544]
[2026/05/22 10:58:58.919047, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/wb_lookupsid.c:61(wb_lookupsid_send)
  Looking up SID S-1-5-32-544 in domain BUILTIN.
[2026/05/22 10:58:58.949377,  5, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv)
  WB command lookupsid end.
[2026/05/22 10:58:58.949415,  1, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/wb_lookupsid.c:102(wb_lookupsid_recv)
  Failed with NT_STATUS_CONNECTION_DISCONNECTED.
[2026/05/22 10:58:58.949433,  5, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd_lookupsid.c:94(winbindd_lookupsid_recv)
  Could not lookup sid S-1-5-32-544: NT_STATUS_CONNECTION_DISCONNECTED
[2026/05/22 10:58:58.949449,  3, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:564(process_request_done)
  process_request_done: [wbinfo(6566):LOOKUPSID]: NT_STATUS_CONNECTION_DISCONNECTED
[2026/05/22 10:58:58.949484, 10, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:609(process_request_written)
  process_request_written: [wbinfo(6566):LOOKUPSID]: delivered response to client
[2026/05/22 10:58:58.949549,  6, pid=6266, effective(0, 0), real(0, 0), class=winbind] source3/winbindd/winbindd.c:725(winbind_client_request_read)
  closing socket 24, client exited

Took me way longer than I'd like to admit to track that down.

Where did you find it?

https://developers.openai.com/codex/concepts/sandboxing)

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

codex - 💡(How to fix) Fix Sandbox docs: Suggestion to install apparmor can break samba