Failed to start AppArmor initialization with status=123/n/a

Bug #1756800 reported by Rocko on 2018-03-19
34
This bug affects 6 people
Affects Status Importance Assigned to Milestone
apparmor (Ubuntu)
Medium
Jamie Strandboge
ubuntu-release-upgrader (Ubuntu)
Undecided
Unassigned

Bug Description

AppArmor in Ubuntu 18.04 fails to start every time:

$ systemctl status apparmor.service
● apparmor.service - AppArmor initialization
   Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Mon 2018-03-19 13:47:22 AWST; 56s ago
     Docs: man:apparmor(7)
           http://wiki.apparmor.net/
  Process: 773 ExecStart=/etc/init.d/apparmor start (code=exited, status=123)
 Main PID: 773 (code=exited, status=123)

Mar 19 13:47:21 xps15-9560 apparmor[773]: AppArmor parser error for /etc/apparmor.d/usr.lib.mediascanner-2.0.mediascanner-extractor in /e
Mar 19 13:47:21 xps15-9560 apparmor[773]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
Mar 19 13:47:22 xps15-9560 apparmor[773]: Skipping profile in /etc/apparmor.d/disable: usr.bin.firefox
Mar 19 13:47:22 xps15-9560 apparmor[773]: AppArmor parser error for /etc/apparmor.d/usr.bin.webbrowser-app in /etc/apparmor.d/usr.bin.web
Mar 19 13:47:22 xps15-9560 apparmor[773]: AppArmor parser error for /etc/apparmor.d/usr.lib.mediascanner-2.0.mediascanner-extractor in /e
Mar 19 13:47:22 xps15-9560 apparmor[773]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
Mar 19 13:47:22 xps15-9560 apparmor[773]: ...fail!
Mar 19 13:47:22 xps15-9560 systemd[1]: apparmor.service: Main process exited, code=exited, status=123/n/a
Mar 19 13:47:22 xps15-9560 systemd[1]: apparmor.service: Failed with result 'exit-code'.
Mar 19 13:47:22 xps15-9560 systemd[1]: Failed to start AppArmor initialization.

journalctl -xe gives essentially the same lack of information issued after a systemctl restart apparmor.service.

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: apparmor 2.11.0-2ubuntu19
ProcVersionSignature: Ubuntu 4.15.0-12.13-generic 4.15.7
Uname: Linux 4.15.0-12-generic x86_64
ApportVersion: 2.20.8-0ubuntu10
Architecture: amd64
Date: Mon Mar 19 13:50:42 2018
InstallationDate: Installed on 2017-08-16 (214 days ago)
InstallationMedia: Ubuntu 17.04 "Zesty Zapus" - Release amd64 (20170412)
ProcEnviron:
 LANGUAGE=en_AU:en
 TERM=xterm-256color
 PATH=(custom, no user)
 LANG=en_AU.UTF-8
 SHELL=/bin/bash
ProcKernelCmdline: BOOT_IMAGE=/@/boot/vmlinuz-4.15.0-12-generic root=UUID=0eb64261-6dff-464a-8373-596794c1fafe ro rootflags=subvol=@ quiet splash acpi_rev_override=5 scsi_mod.use_blk_mq=1 vt.handoff=1
SourcePackage: apparmor
Syslog:
 Mar 19 13:47:22 xps15-9560 dbus-daemon[1252]: [system] AppArmor D-Bus mediation is enabled
 Mar 19 13:47:23 xps15-9560 dbus-daemon[1491]: [session uid=125 pid=1491] AppArmor D-Bus mediation is enabled
 Mar 19 13:47:39 xps15-9560 dbus-daemon[2160]: [session uid=1001 pid=2160] AppArmor D-Bus mediation is enabled
UpgradeStatus: Upgraded to bionic on 2017-11-17 (121 days ago)
mtime.conffile..etc.apparmor.d.abstractions.nameservice: 2017-10-24T16:47:24.395996

Rocko (rockorequin) wrote :
Rocko (rockorequin) wrote :

Another user reported what sounds like the same issue at https://ubuntuforums.org/showthread.php?t=2386129&p=13749658#post13749658

Seth Arnold (seth-arnold) wrote :

Hello Rocko,

Can you try the following?

sudo apparmor_parser --replace /etc/apparmor.d/usr.bin.webbrowser-app
sudo apparmor_parser --replace /etc/apparmor.d/usr.lib.mediascanner-2.0.mediascanner-extractor

Thanks

Rocko (rockorequin) wrote :

I get this:

$ sudo apparmor_parser --replace /etc/apparmor.d/usr.bin.webbrowser-app
AppArmor parser error for /etc/apparmor.d/usr.bin.webbrowser-app in /etc/apparmor.d/usr.bin.webbrowser-app at line 26: Could not open '/usr/share/apparmor/hardware/graphics.d'

$ sudo apparmor_parser --replace /etc/apparmor.d/usr.lib.mediascanner-2.0.mediascanner-extractor
AppArmor parser error for /etc/apparmor.d/usr.lib.mediascanner-2.0.mediascanner-extractor in /etc/apparmor.d/usr.lib.mediascanner-2.0.mediascanner-extractor at line 14: Could not open '/usr/share/apparmor/hardware/audio.d'

FWIW, I don't actually have a /usr/share/apparmor folder.

Would these errors prevent apparmor from running at all?

Jamie Strandboge (jdstrand) wrote :

No, the script is returning non-zero because some of the profiles didn't load, but the rest of the profiles will load fine. You can prove this to yourself using 'sudo aa-status'.

As for those two profiles, the come from https://launchpad.net/ubuntu/+source/webbrowser-app/ and https://launchpad.net/ubuntu/+source/mediascanner2/, both of which have been removed from 18.04. It sounds like these packages are still installed on you system, you can remove them with:

$ sudo apt-get remove --purge webbrowser-app mediascanner2.0

Jamie Strandboge (jdstrand) wrote :

This isn't really a bug in apparmor-- the profiles weren't purged from the system. We could perhaps add a Conflicts on webbrowser-app mediascanner2.0 to apparmor, but that doesn't feel right (and wouldn't remove the conffiles anyway (so this bug would remain)). Perhaps ubuntu-release-upgrader could be modified to remove the files on upgrade... adding a task for that.

Changed in apparmor (Ubuntu):
status: New → Won't Fix
Rocko (rockorequin) wrote :

Thanks, removing the packages makes the errors go away.

Do you think the error message is misleading? Instead of saying "Failed to start AppArmor initialization", perhaps it should say, "Failed to load some profiles"?

On Wed, Mar 21, 2018 at 12:46:04AM -0000, Rocko wrote:
> Thanks, removing the packages makes the errors go away.

Good, I'm glad to hear this worked.

> Do you think the error message is misleading? Instead of saying "Failed
> to start AppArmor initialization", perhaps it should say, "Failed to
> load some profiles"?

This error message is provided by systemd: "Failed to start" followed
by the Description field from the service file. There's no mechanism to
customize the message on success vs failure.

Thanks

Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in ubuntu-release-upgrader (Ubuntu):
status: New → Confirmed
Seth Arnold (seth-arnold) wrote :

Infinity suggests:

- Versioned breaks from apparmor against the other two packages
- Using the apparmor maintainer scripts to remove the conffiles

Thanks

Changed in apparmor (Ubuntu):
assignee: nobody → Jamie Strandboge (jdstrand)
status: Won't Fix → In Progress
Changed in ubuntu-release-upgrader (Ubuntu):
status: Confirmed → Won't Fix
Jamie Strandboge (jdstrand) wrote :

media-hub is another application that was removed in bionic that is affected.

Changed in apparmor (Ubuntu):
status: In Progress → Fix Committed
Jamie Strandboge (jdstrand) wrote :

Uploaded 2.12-4ubuntu3 to address this.

Steve Langasek (vorlon) on 2018-04-04
Changed in apparmor (Ubuntu):
importance: Undecided → Medium
Seth Arnold (seth-arnold) wrote :
Download full text (6.4 KiB)

$ diff -u <(grep etc/apparmor.d Contents-xenial | awk '{print $1}') <(grep etc/apparmor.d Contents-bionic | awk '{print $1}')
--- /dev/fd/63 2018-04-03 17:45:57.438698038 -0700
+++ /dev/fd/62 2018-04-03 17:45:57.438698038 -0700
@@ -23,16 +23,19 @@
 etc/apparmor.d/abstractions/enchant
 etc/apparmor.d/abstractions/evince
 etc/apparmor.d/abstractions/fcitx
+etc/apparmor.d/abstractions/fcitx-strict
 etc/apparmor.d/abstractions/fonts
 etc/apparmor.d/abstractions/freedesktop.org
 etc/apparmor.d/abstractions/gnome
 etc/apparmor.d/abstractions/gnupg
 etc/apparmor.d/abstractions/gstreamer
+etc/apparmor.d/abstractions/i2p
 etc/apparmor.d/abstractions/ibus
 etc/apparmor.d/abstractions/kde
 etc/apparmor.d/abstractions/kerberosclient
 etc/apparmor.d/abstractions/launchpad-integration
 etc/apparmor.d/abstractions/ldapclient
+etc/apparmor.d/abstractions/libpam-systemd
 etc/apparmor.d/abstractions/libvirt-lxc
 etc/apparmor.d/abstractions/libvirt-qemu
 etc/apparmor.d/abstractions/lightdm
@@ -42,7 +45,8 @@
 etc/apparmor.d/abstractions/lxc/start-container
 etc/apparmor.d/abstractions/mdns
 etc/apparmor.d/abstractions/mir
-etc/apparmor.d/abstractions/mozc_server
+etc/apparmor.d/abstractions/mozc
+etc/apparmor.d/abstractions/mozc-server
 etc/apparmor.d/abstractions/mysql
 etc/apparmor.d/abstractions/nameservice
 etc/apparmor.d/abstractions/nis
@@ -51,6 +55,7 @@
 etc/apparmor.d/abstractions/orbit2
 etc/apparmor.d/abstractions/p11-kit
 etc/apparmor.d/abstractions/perl
+etc/apparmor.d/abstractions/php
 etc/apparmor.d/abstractions/php5
 etc/apparmor.d/abstractions/postfix-common
 etc/apparmor.d/abstractions/private-files
@@ -94,23 +99,25 @@
 etc/apparmor.d/abstractions/user-tmp
 etc/apparmor.d/abstractions/user-write
 etc/apparmor.d/abstractions/video
+etc/apparmor.d/abstractions/wayland
 etc/apparmor.d/abstractions/web-data
 etc/apparmor.d/abstractions/winbind
 etc/apparmor.d/abstractions/wutmp
 etc/apparmor.d/abstractions/xad
 etc/apparmor.d/abstractions/xdg-desktop
+etc/apparmor.d/apache2.d/kopano-webapp
 etc/apparmor.d/apache2.d/phpsysinfo
 etc/apparmor.d/bin.ping
-etc/apparmor.d/content-hub-testability
 etc/apparmor.d/dhcpd.d/maas
+etc/apparmor.d/firejail-default
 etc/apparmor.d/gst_plugin_scanner
 etc/apparmor.d/libvirt/TEMPLATE.lxc
 etc/apparmor.d/libvirt/TEMPLATE.qemu
 etc/apparmor.d/lightdm-guest-session
+etc/apparmor.d/lightdm-remote-session-x2go
 etc/apparmor.d/local/README
+etc/apparmor.d/local/firejail-local
 etc/apparmor.d/local/usr.sbin.apache2
-etc/apparmor.d/local/usr.sbin.libvirtd
-etc/apparmor.d/local/usr.sbin.named
 etc/apparmor.d/lxc-containers
 etc/apparmor.d/lxc/lxc-default
 etc/apparmor.d/lxc/lxc-default-cgns
@@ -118,40 +125,43 @@
 etc/apparmor.d/lxc/lxc-default-with-nesting
 etc/apparmor.d/sbin.aprx
 etc/apparmor.d/sbin.dhclient
+etc/apparmor.d/sbin.dhcpcanon
 etc/apparmor.d/sbin.klogd
 etc/apparmor.d/sbin.syslog-ng
 etc/apparmor.d/sbin.syslogd
+etc/apparmor.d/system_i2p
 etc/apparmor.d/system_tor
 etc/apparmor.d/tunables/alias
 etc/apparmor.d/tunables/apparmorfs
 etc/apparmor.d/tunables/dovecot
 etc/apparmor.d/tunables/global
 etc/apparmor.d/tunables/home
+etc/apparmor.d/tunables/home.d/site.local
 etc/apparmor.d/tunables/kernelvars
 etc/app...

Read more...

Seth Arnold (seth-arnold) wrote :

Do we need to worry about:

ubuntu-download-manager: /etc/apparmor.d/usr.lib.ubuntu-download-manager.udm-extractor
messaging-app: /etc/apparmor.d/usr.bin.messaging-app
content-hub-testability: /etc/apparmor.d/content-hub-testability

Thanks

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apparmor - 2.12-4ubuntu3

---------------
apparmor (2.12-4ubuntu3) bionic; urgency=medium

  * Remove old Ubuntu Touch profiles for packages removed from the archive
    since they need apparmor-easyprof-ubuntu to compile, and it was also
    removed from the archive (LP: #1756800)
    - debian/control: Breaks on media-hub, mediascanner2.0 and webbrowser-app
    - debian/postinst: on upgrade, remove profiles for usr.bin.webbrowser-app,
      usr.bin.media-hub-server, usr.lib.mediascanner-2.0.mediascanner-extractor
      and usr.bin.mediascanner-service-2.0

 -- Jamie Strandboge <email address hidden> Tue, 03 Apr 2018 13:12:46 +0000

Changed in apparmor (Ubuntu):
status: Fix Committed → Fix Released
Jamie Strandboge (jdstrand) wrote :

"Do we need to worry about:

ubuntu-download-manager: /etc/apparmor.d/usr.lib.ubuntu-download-manager.udm-extractor
messaging-app: /etc/apparmor.d/usr.bin.messaging-app
content-hub-testability: /etc/apparmor.d/content-hub-testability
"

Yes. I did an archive grep and found media-hub, but that grep didn't find these since they generate the profile from debian/rules. I'm running a new grep to catch that and will update apparmor accordingly.

Jamie Strandboge (jdstrand) wrote :

Actually, only messaging-app is affected by this bug, so we don't need to remove the other two.

marsteegh (marsteegh) wrote :

I have a similar issue, getting these messages from apparmor:

May 28 06:52:02 bureau apparmor[993]: AppArmor parser error for /etc/apparmor.d/usr.sbin.nscd in /etc/apparmor.d/tunables/multiarch at line 13: syntax error, unexpected TOK_EQUALS, expecting TOK_OPEN
May 28 06:52:02 bureau apparmor[993]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
May 28 06:52:02 bureau apparmor[993]: AppArmor parser error for /etc/apparmor.d/usr.sbin.smbd in /etc/apparmor.d/tunables/multiarch at line 13: syntax error, unexpected TOK_EQUALS, expecting TOK_OPEN
May 28 06:52:02 bureau apparmor[993]: AppArmor parser error for /etc/apparmor.d/usr.sbin.smbldap-useradd in /etc/apparmor.d/tunables/multiarch at line 13: syntax error, unexpected TOK_EQUALS, expecting TOK
May 28 06:52:02 bureau apparmor[993]: AppArmor parser error for /etc/apparmor.d/usr.sbin.tcpdump in /etc/apparmor.d/tunables/multiarch at line 13: syntax error, unexpected TOK_EQUALS, expecting TOK_OPEN
May 28 06:52:02 bureau apparmor[993]: AppArmor parser error for /etc/apparmor.d/usr.sbin.traceroute in /etc/apparmor.d/tunables/multiarch at line 13: syntax error, unexpected TOK_EQUALS, expecting TOK_OPEN
May 28 06:52:02 bureau apparmor[993]: ...fail!

However, I think the error is deeper than some faulty profiles because no profiles get loaded at all:

> sudo aa-status
apparmor module is loaded.
0 profiles are loaded.
0 profiles are in enforce mode.
0 profiles are in complain mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

Does anybody have a suggestion for how to investigate further?

Christian Boltz (cboltz) wrote :

Looks like you have a syntax error in /etc/apparmor.d/tunables/multiarch around line 13. Can you please attach this file? Also, did you modify it manually?

Ron (shinazueli) wrote :

This may be a dumb question, but once we *have* this bug, how do we fix it? I'm not that practiced at apparmor.

Seth Arnold (seth-arnold) wrote :

Ron, you look at the profiles that failed to compile/load in the journalctl -u apparmor output, and decide what to do with those profiles -- if they are for programs that no longer exist because the package has since been removed, you can just delete the profile file. If they are for programs that you use, then you should fix whatever error is in the profile.

More details would require more details. Consider filing a new bug if you've got this error with profiles that were provided by a package.

Thanks

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers