Can not load mysql-akonadi apparmor profile

[Benedikt]

Apparmor fails to start witch exit code 123, because it can not load the mysql-akonadi profile:

% sudo systemctl status apparmor -l
● apparmor.service - LSB: AppArmor initialization
   Loaded: loaded (/etc/init.d/apparmor)
   Active: failed (Result: exit-code) since So 2015-04-05 12:29:33 CEST; 55s ago
     Docs: man:systemd-sysv-generator(8)
  Process: 13906 ExecStart=/etc/init.d/apparmor start (code=exited, status=123)

Apr 05 12:29:33 benediktZ50-70 apparmor[13906]: Skipping profile in /etc/apparmor.d/disable: usr.bin.firefox
Apr 05 12:29:33 benediktZ50-70 apparmor[13906]: AppArmor parser error for /etc/apparmor.d/usr.sbin.mysqld-akonadi in /etc/apparmor.d/usr.sbin.mysqld-akonadi at line 31: Could not open 'local/usr.sbin.mysqld-akonadi'
Apr 05 12:29:33 benediktZ50-70 apparmor[13906]: Skipping profile in /etc/apparmor.d/disable: usr.bin.firefox
Apr 05 12:29:33 benediktZ50-70 apparmor[13906]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
Apr 05 12:29:33 benediktZ50-70 apparmor[13906]: AppArmor parser error for /etc/apparmor.d/usr.sbin.mysqld-akonadi in /etc/apparmor.d/usr.sbin.mysqld-akonadi at line 31: Could not open 'local/usr.sbin.mysqld-akonadi'
Apr 05 12:29:33 benediktZ50-70 apparmor[13906]: ...fail!
Apr 05 12:29:33 benediktZ50-70 systemd[1]: apparmor.service: control process exited, code=exited status=123
Apr 05 12:29:33 benediktZ50-70 systemd[1]: Failed to start LSB: AppArmor initialization.
Apr 05 12:29:33 benediktZ50-70 systemd[1]: Unit apparmor.service entered failed state.
Apr 05 12:29:33 benediktZ50-70 systemd[1]: apparmor.service failed.

However Apparmor loaded successfully:

% sudo aa-status
apparmor module is loaded.
17 profiles are loaded.
17 profiles are in enforce mode.
   /sbin/dhclient
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/cups/backend/cups-pdf
   /usr/lib/libvirt/virt-aa-helper
   /usr/lib/telepathy/mission-control-5
   /usr/lib/telepathy/telepathy-*
   /usr/lib/telepathy/telepathy-*//pxgsettings
   /usr/lib/telepathy/telepathy-*//sanitized_helper
   /usr/lib/telepathy/telepathy-ofono
   /usr/sbin/cups-browsed
   /usr/sbin/cupsd
   /usr/sbin/cupsd//third_party
   /usr/sbin/libvirtd
   /usr/sbin/tcpdump
   docker-default
0 profiles are in complain mode.
5 processes have profiles defined.
5 processes are in enforce mode.
   /sbin/dhclient (11821)
   /usr/lib/telepathy/mission-control-5 (2008)
   /usr/sbin/cups-browsed (840)
   /usr/sbin/cupsd (12783)
   /usr/sbin/libvirtd (971)
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

It is really necessary to set Apparmor as failed if one profile could not be loaded?

[Martin Tang (infinitesimal)]

Putting a file in /etc/apparmor.d/local/usr.sbin.mysqld-akonadi (like the other examples already there) resolves the issue. Maybe the packaging for akonadi-backend-mysql forgot to generate an empty configuration file there?

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Steve Beattie (sbeattie)]

For some reason, the dh-apparmor hook invocation in the akonadi package is not causing the postinst script to be created for the akonadi-backend-mysql package that would create the /etc/apparmor.d/local/usr.sbin.mysqld-akonadi file on package installation, despite the dh-apparmor script calling autoscript() for this precise reason.

[Steve Beattie (sbeattie)]

Ah, this merge http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/vivid/akonadi/vivid-proposed/revision/102#debian/rules disabled the override_dh_installinit: target in debian/rules, preventing dh-apparmor from generating the postinst script that would create /etc/apparmor.d/local/usr.sbin.mysqld-akonadi at package install time.

[Steve Beattie (sbeattie)]

The attached debdiff fixes the issue.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "akonadi_1.13.0-2ubuntu4.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Launchpad Janitor (janitor)]

This bug was fixed in the package akonadi - 1.13.0-2ubuntu4

---------------
akonadi (1.13.0-2ubuntu4) vivid; urgency=medium

  * debian/rules: re-enable the override_dh_installinit target, disabled
    in an earlier merge from debian. This allows dh-apparmor to create
    the postinst for the akonadi-backend-mysql package, which creates
    the missing part of that package's apparmor profile at install time
    (LP: #1440501)
 -- Steve Beattie <email address hidden> Wed, 15 Apr 2015 10:48:33 -0700