akonadi in kubuntu karmic backports does not work due to incomplete apparmor profile

[Jörn Hees]

Since upgrading to KDE 4.4 I had several problems with the akonadi-server not starting up properly.
The package I currently want to blame this on is akonadi-server-1.3.1-0ubuntu1~karmic1~ppa2 .

Issues:
In the akonaditray's selftest I found the server not starting up due to:

  [ERROR] Can't open and lock privilege tables: Table 'mysql.servers' doesn't exist
  [ERROR] Cannot open mysql.db
  [ERROR] Cannot open mysql.user
  [ERROR] Cannot open mysql.event

You quickly find this page: http://userbase.kde.org/Akonadi
After everything else in there didn't quite work out, I tried:
  mysql_install_db --datadir=$HOME/.local/share/akonadi/db_data/
This failed, which is why I thought about the whole apparmor issues mentioned in the page linked above.
So I disabled apparmor:
  /etc/init.d/apparmor stop
And retried the above command, voila, it works. Now I guess this is why akonadi can't initialize its db properly. OK, I started akonadi, etc. everything worked fine (notice that apparmor was still turned off), until i rebooted. When apparmor is activated again, the akonadi server won't startup properly, as it lacks permission to access some files. This is a critical problem, as kmail didn't startup anymore. So I investigated further and set the mysqld-akonadi to complain mode in apparmor.
This pointed me to add the following lines to /etc/apparmor.d/usr.sbin.mysqld-akonadi:
   /sys/devices/system/cpu/ r, # joern
  /etc/mysql/my.cnf r,
  /etc/mysql/conf.d/ r,
  /etc/mysql/conf.d/mysqld_safe_syslog.cnf r,
(just above the closing }-bracket.)

With these additions and after /etc/init.d/apparmor reload the akonadi-server starts up properly.

So again: akonadi seems to need apparmor to be turned off to once initialize its db (tried this manually only) and after that needs the profile to be modified to allow read access to above mentioned files/dirs.
I don't know why it needs this access, but afaik read access to them is quite ok.

Regards,
Jörn

[Jörn Hees (joernhees)]

Sorry, left my trace in the lines to add to the files, so you can safely ignore the "# joern" comment:
   /sys/devices/system/cpu/ r,
   /etc/mysql/my.cnf r,
   /etc/mysql/conf.d/ r,
   /etc/mysql/conf.d/mysqld_safe_syslog.cnf r,