All that said, Daniel and Jean-Baptiste, I installed 20.04 in a vm and tried to reproduce this and could not. The apparmor change was about correctness of the unit so I performed the upload, but I also hoped that it would address the issue you are seeing.
I'm not certain it will. On one boot, prior to upgrading apparmor, I saw:
$ sudo systemd-analyze critical-chain apparmor.service
The time when unit became active or started is printed after the "@" character.
The time the unit took to start is printed after the "+" character.
Note that var-lib.mount is already listed. On reboot though (without updating apparmor), I see:
$ sudo systemd-analyze critical-chain apparmor.service
The time when unit became active or started is printed after the "@" character.
The time the unit took to start is printed after the "+" character.
Oddly, no zfs entries are listed apparently because local-fs.target isn't pulling them in:
$ sudo systemd-analyze critical-chain local-fs.target
The time when unit became active or started is printed after the "@" character.
The time the unit took to start is printed after the "+" character.
$ sudo systemd-analyze critical-chain var-lib.mount
The time when unit became active or started is printed after the "@" character.
The time the unit took to start is printed after the "+" character.
So why after a reboot did the dependencies change and drop the /var/lib entry from local-fs.target?
I then upgraded apparmor to have the RequiresMountsFor /var/lib/snapd/apparmor/profiles, rebooted and saw no difference:
$ sudo systemd-analyze critical-chain apparmor.service
The time when unit became active or started is printed after the "@" character.
The time the unit took to start is printed after the "+" character.
All that said, Daniel and Jean-Baptiste, I installed 20.04 in a vm and tried to reproduce this and could not. The apparmor change was about correctness of the unit so I performed the upload, but I also hoped that it would address the issue you are seeing.
I'm not certain it will. On one boot, prior to upgrading apparmor, I saw:
$ sudo systemd-analyze critical-chain apparmor.service
The time when unit became active or started is printed after the "@" character.
The time the unit took to start is printed after the "+" character.
apparmor.service +11.135s mount.service @4.327s +48ms lib-dpkg. mount @4.188s +137ms ─var-lib. mount @3.883s +250ms
└─zfs- import. target @3.829s
└─zfs- import- cache.service @3.125s +704ms
└─ zfs-load- module. service @3.121s +2ms
└─systemd- udev-settle. service @1.183s +1.937s
└─systemd- udev-trigger. service @933ms +248ms
└─systemd- udevd-kernel. socket @886ms
└ ─system. slice @535ms
└─-.slice @535ms
└─local-fs.target @4.376s
└─zfs-
└─var-
└
Note that var-lib.mount is already listed. On reboot though (without updating apparmor), I see:
$ sudo systemd-analyze critical-chain apparmor.service
The time when unit became active or started is printed after the "@" character.
The time the unit took to start is printed after the "+" character.
apparmor.service +101ms user-122. mount @5.172s ─dev-disk- by\x2duuid- f5ea22a0\ x2de078\ x2d4d8e\ x2d9412\ x2d1fad2171a080 .swap @1.799s +22ms
└─dev- disk-by\ x2duuid- f5ea22a0\ x2de078\ x2d4d8e\ x2d9412\ x2d1fad2171a080 .device @1.798s
└─local-fs.target @2.812s
└─run-
└─swap.target @1.823s
└
Oddly, no zfs entries are listed apparently because local-fs.target isn't pulling them in:
$ sudo systemd-analyze critical-chain local-fs.target
The time when unit became active or started is printed after the "@" character.
The time the unit took to start is printed after the "+" character.
local-fs.target @2.812s 122.mount @5.172s disk-by\ x2duuid- f5ea22a0\ x2de078\ x2d4d8e\ x2d9412\ x2d1fad2171a080 .swap @1.799s +22ms ─dev-disk- by\x2duuid- f5ea22a0\ x2de078\ x2d4d8e\ x2d9412\ x2d1fad2171a080 .device @1.798s
└─run-user-
└─swap.target @1.823s
└─dev-
└
Looking at var-lib.mount, I see zfs is in there:
$ sudo systemd-analyze critical-chain var-lib.mount
The time when unit became active or started is printed after the "@" character.
The time the unit took to start is printed after the "+" character.
var-lib.mount +179ms import- cache.service @1.845s +402ms load-module. service @1.840s +2ms ─systemd- udev-settle. service @692ms +1.143s
└─systemd- udev-trigger. service @524ms +167ms
└─systemd- udevd-kernel. socket @494ms
└─ system. slice @357ms
└─-.slice @357ms
└─zfs-import.target @2.248s
└─zfs-
└─zfs-
└
So why after a reboot did the dependencies change and drop the /var/lib entry from local-fs.target?
I then upgraded apparmor to have the RequiresMountsFor /var/lib/ snapd/apparmor/ profiles, rebooted and saw no difference:
$ sudo systemd-analyze critical-chain apparmor.service
The time when unit became active or started is printed after the "@" character.
The time the unit took to start is printed after the "+" character.
apparmor.service +222ms user-122. mount @4.834s ─dev-disk- by\x2duuid- f5ea22a0\ x2de078\ x2d4d8e\ x2d9412\ x2d1fad2171a080 .swap @1.663s +24ms
└─dev- disk-by\ x2duuid- f5ea22a0\ x2de078\ x2d4d8e\ x2d9412\ x2d1fad2171a080 .device @1.662s
└─local-fs.target @2.562s
└─run-
└─swap.target @1.687s
└