apparmor fails to start

[nick chapman]

acer@acer-Aspire-F5-573G:~$ systemctl status apparmor.service
● apparmor.service - AppArmor initialization
   Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; vendor preset:
   Active: failed (Result: exit-code) since Mon 2018-02-26 07:32:58 +07; 9min ag
     Docs: man:apparmor(7)
           http://wiki.apparmor.net/
  Process: 352 ExecStart=/etc/init.d/apparmor start (code=exited, status=123)
 Main PID: 352 (code=exited, status=123)

Feb 26 07:32:57 acer-Aspire-F5-573G apparmor[352]: Skipping profile in /etc/appa
Feb 26 07:32:57 acer-Aspire-F5-573G apparmor[352]: Skipping profile in /etc/appa
Feb 26 07:32:57 acer-Aspire-F5-573G apparmor[352]: AppArmor parser error for /et
Feb 26 07:32:57 acer-Aspire-F5-573G apparmor[352]: AppArmor parser error for /et
Feb 26 07:32:57 acer-Aspire-F5-573G apparmor[352]: Skipping profile in /etc/appa
Feb 26 07:32:58 acer-Aspire-F5-573G apparmor[352]: ...fail!
Feb 26 07:32:58 acer-Aspire-F5-573G systemd[1]: apparmor.service: Main process e
Feb 26 07:32:58 acer-Aspire-F5-573G systemd[1]: Failed to start AppArmor initial
Feb 26 07:32:58 acer-Aspire-F5-573G systemd[1]: apparmor.service: Unit entered f
Feb 26 07:32:58 acer-Aspire-F5-573G systemd[1]: apparmor.service: Failed with re

[Christian Boltz (cboltz)]

Unfortunately the interesting parts are cut off. Can you please provide the full lines?

systemctl status -l apparmor.service | cat

should help to avoid that the lines get cut and/or displayed in a pager.

[Victor van den Bogaert (victor03303)]

I see this thread is getting its age but I come across the same

systemctl status -l apparmor.service | cat
● apparmor.service - Load AppArmor profiles
     Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Sat 2020-07-11 09:56:14 CEST; 44min ago
       Docs: man:apparmor(7)
             https://gitlab.com/apparmor/apparmor/wikis/home/
    Process: 1002 ExecStart=/lib/apparmor/apparmor.systemd reload (code=exited, status=1/FAILURE)
   Main PID: 1002 (code=exited, status=1/FAILURE)

jul 11 09:56:14 michael-toren apparmor.systemd[1013]: AppArmor parser error for /etc/apparmor.d in /etc/apparmor.d/usr.lib.snapd.snap-confine.real at line 11: Could not open '/var/lib/snapd/apparmor/snap-confine'
jul 11 09:56:14 michael-toren apparmor.systemd[1020]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
jul 11 09:56:14 michael-toren apparmor.systemd[1019]: Skipping profile in /etc/apparmor.d/disable: usr.bin.firefox
jul 11 09:56:14 michael-toren apparmor.systemd[1059]: Skipping profile in /etc/apparmor.d/disable: usr.bin.firefox
jul 11 09:56:14 michael-toren apparmor.systemd[1086]: AppArmor parser error for /etc/apparmor.d/usr.lib.snapd.snap-confine.real in /etc/apparmor.d/usr.lib.snapd.snap-confine.real at line 11: Could not open '/var/lib/snapd/apparmor/snap-confine'
jul 11 09:56:14 michael-toren apparmor.systemd[1103]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
jul 11 09:56:14 michael-toren apparmor.systemd[1002]: Error: At least one profile failed to load
jul 11 09:56:14 michael-toren systemd[1]: apparmor.service: Main process exited, code=exited, status=1/FAILURE
jul 11 09:56:14 michael-toren systemd[1]: apparmor.service: Failed with result 'exit-code'.
jul 11 09:56:14 michael-toren systemd[1]: Failed to start Load AppArmor profiles.

I see 'snapd' in this text but I don't have it installed. I don't want it on my system.

I'm need apparmor running to file an other bug that's making my system to crash randomly

[Victor van den Bogaert (victor03303)]

It's solved! :D

I'm part of the Lubuntu Telegram channel. They told me that I had use `sudo apt purge snapd` instead of `sudo apt remove snapd`. Than I restarted the apparmor service and the computer and in both cases apparmor service was doing just fine!

But it strikes me as odd tough that this was the solution ...

[Jamie Strandboge (jdstrand)]

Please note that the apparmor unit will not stop loading profiles if some fail to load (ie, it should load all the profiles it is able to; if that isn't the case, that would be a bug in the unit), but if there are any errors loading any of the profiles, the unit will be marked in the failed state.

The reason the solution worked for you is due to deb packaging. Files in /etc are treated differently than other files and are only removed when purging. This is a feature of deb policy and tooling since it would allow you to not lose valuable configuration on package removal, but this can sometimes create awkward situations like the one you faced, where a file in /etc references a directory in /var that was removed.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.