Letsencrypt error: cannot change profile for the next exec call: No such file or directory

[robbrandt]

SYSTEM INFORMATION
OS type and version:	Ubuntu 20.04.3
Webmin version:	1.981
Virtualmin version:	6.17-3

---

I have site on my server that has been renewing OK until this week. When it attempts to renew it gets this error:

I’ve googled but I can’t see anything that seems relevant. A snap issue of some sort?

[Joe]

Yes, it’s coming from the container or AppArmor, apparently. It can reportedly be caused by memory/CPU contention…maybe you need more memory or you need to cut down on what you’re doing with the system.

One suggested workardound was to restart apparmor.

It’s not coming from Webmin/Virtualmin, though, and I’ve never seen it, so I’m as lost as you are.

[robbrandt]

Thanks. There’s tons of memory and the server runs at low load. About 10gb free normally.

I tried restarting " apparmor.service" but it didn’t help. Here’s app armor status. Maybe you can spot something webmin/letsencrypt needs that isn’t there? Otherwise I will address this with the letsencrypt community.

apparmor module is loaded.
22 profiles are loaded.
22 profiles are in enforce mode.
/usr/bin/freshclam
/usr/bin/lxc-start
/usr/bin/man
/usr/lib/NetworkManager/nm-dhcp-client.action
/usr/lib/NetworkManager/nm-dhcp-helper
/usr/lib/connman/scripts/dhclient-script
/usr/lib/snapd/snap-confine
/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
/usr/sbin/clamd
/usr/sbin/mysqld
/usr/sbin/named
/usr/sbin/tcpdump
/{,usr/}sbin/dhclient
lsb_release
lxc-container-default
lxc-container-default-cgns
lxc-container-default-with-mounting
lxc-container-default-with-nesting
man_filter
man_groff
nvidia_modprobe
nvidia_modprobe//kmod
0 profiles are in complain mode.
4 processes have profiles defined.
4 processes are in enforce mode.
/usr/bin/freshclam (902)
/usr/sbin/mysqld (1082)
/usr/sbin/named (170608)
/sbin/dhclient (683) /{,usr/}sbin/dhclient
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

[robbrandt]

Am I used Certbot? I have lost track of whether Virtualmin uses it or has it’s own methods.

The question arises because the LetsEncrypt forum/help system asks this question and asks for the output of certbot --version, which yields:
cannot change profile for the next exec call: No such file or directory

So maybe the certbot profile is missing?

[robbrandt]

LetsEncrypt people kicked it back over here. They say all looks good with my account. And they don’t know much about Virtualmin.

So. Does Virtualmin use certbot?

[Joe]

If there is a system package for certbot available at install time. Ubuntu 20.04 has certbot in the system repos, so, you are using certbot.

[Joe]

@robbrandt

The question arises because the LetsEncrypt forum/help system asks this question and asks for the output of certbot --version, which yields:
cannot change profile for the next exec call: No such file or directory

@robbrandt

LetsEncrypt people kicked it back over here. They say all looks good with my account. And they don’t know much about Virtualmin.

How could this possibly be Virtualmin? You ran certbot on the command line and got the same error. There is no Virtualmin involved when you run certbot on the command line.

If it is not an issue for Let’s Encrypt folks, it would be an issue for Ubuntu folks, I guess. I dunno. Nobody else has reported this problem, though, and there are a lot of Virtualmin users using Ubuntu 20.04.