[MAAS 2.2] apparmor_parser: enable to replace "/usr/sbin/dhcpd" [spurious error during dist-upgrade in container?]

[Mike Pontillo]

I used 'apt-get dist-upgrade' to upgrade my home MAAS from 2.2rc3 to 2.2rc4, and saw the following output scroll by:

Setting up maas-dhcp (2.2.0~rc4+bzr6048-0ubuntu1~16.04.1) ...
apparmor_parser: Unable to replace "/usr/sbin/dhcpd". Permission denied; attempted to load a profile while confined?

MAAS is installed in a container and has the following in its configuration:

config:
  raw.lxc: |-
    lxc.aa_profile=unconfined
             lxc.cgroup.devices.allow = b 7:* rwm
             lxc.cgroup.devices.allow = c 10:237 rwm

As a user, I'm now left wondering whether or not the upgrade was fully successful. But the error doesn't make much sense, given that /usr/sbin/dhcpd is provided by isc-dhcp-server, which wasn't touched during the upgrade:

# apt-get dist-upgrade -yu
...
The following packages will be upgraded:
  maas maas-cli maas-common maas-dhcp maas-dns maas-proxy maas-rack-controller maas-region-api maas-region-controller python3-django-maas python3-maas-client python3-maas-provisioningserver
...

# dpkg -S /usr/sbin/dhcpd
isc-dhcp-server: /usr/sbin/dhcpd

[Andres Rodriguez (andreserl)]

It seems you are missing apparmor stuff in your host system to allow the usage, or you have upgraded your apparmor recently, or isc-dhcp on your host machine that could be the culprit.

[Blake Rouse (blake-rouse)]

That message is always show the postinst script handles that failure correctly.

[Mike Pontillo (mpontillo)]

I have the `maas-dhcp` package installed on the host system, as required. That pulls in the `isc-dhcp-server` package, but it's not running on the host system. (only in the container via MAAS.)