apparmor_parser: Unable to replace "/usr/lib/cups/backend/cups-pdf". Profile doesn't conform to protocol

Bug #968956 reported by Oleksij Rempel on 2012-03-30
166
This bug affects 23 people
Affects Status Importance Assigned to Milestone
apparmor (Ubuntu)
Critical
Unassigned

Bug Description

i get this error after current update.

ProblemType: Package
DistroRelease: Ubuntu 12.04
Package: cups 1.5.2-8bzr2
Uname: Linux 3.3.0-09248-g1338631 x86_64
ApportVersion: 1.95-0ubuntu1
Architecture: amd64
Date: Fri Mar 30 09:42:39 2012
ErrorMessage: Unterprozess installiertes post-installation-Skript gab den Fehlerwert 1 zurück
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha amd64 (20120201.1)
Lpstat: Error: command ['lpstat', '-v'] failed with exit code 1: lpstat: Connection refused
MachineType: ASUSTeK Computer Inc. UX31E
Papersize: a4
PpdFiles: Oki-B430: OKI B430(PS)
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.3.0-09248-g1338631 root=UUID=ab2e9ae5-a032-44f5-b956-3223de09edff ro oops=panic panic=10 quiet splash vt.handoff=7
SourcePackage: cups
Title: package cups 1.5.2-8bzr2 failed to install/upgrade: Unterprozess installiertes post-installation-Skript gab den Fehlerwert 1 zurück
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 01/20/2012
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: UX31E.211
dmi.board.asset.tag: ATN12345678901234567
dmi.board.name: UX31E
dmi.board.vendor: ASUSTeK Computer Inc.
dmi.board.version: 1.0
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: ASUSTeK Computer Inc.
dmi.chassis.version: 1.0
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvrUX31E.211:bd01/20/2012:svnASUSTeKComputerInc.:pnUX31E:pvr1.0:rvnASUSTeKComputerInc.:rnUX31E:rvr1.0:cvnASUSTeKComputerInc.:ct10:cvr1.0:
dmi.product.name: UX31E
dmi.product.version: 1.0
dmi.sys.vendor: ASUSTeK Computer Inc.

Related branches

Oleksij Rempel (olerem) wrote :
Till Kamppeter (till-kamppeter) wrote :

The terminal log reads:

----------
Trigger für cups werden verarbeitet ...
start: Job failed to start
invoke-rc.d: initscript cups, action "start" failed.
dpkg: Fehler beim Bearbeiten von cups (--unpack):
 Unterprozess installiertes post-installation-Skript gab den Fehlerwert 1 zurück
----------

Looks like a problem with Upstart, pitti, can you have a look into this?

Is your system completely up-to-date?

Changed in cups (Ubuntu):
status: New → Incomplete
Martin Pitt (pitti) wrote :

Please do

  wget http://people.canonical.com/~pitti/tmp/cups.upstart.debug
  sudo cp /etc/init/cups.conf{,.orig}
  sudo cp cups.upstart.debug /etc/init/cups.conf
  sudo stop cups
  sudo start cups

This should fail again. Please attach /tmp/log here.

After that, please restore the original script again with

  sudo mv /etc/init/cups.conf{.orig,}

Thanks!

Oleksij Rempel (olerem) wrote :

Here is the log

Martin Pitt (pitti) wrote :

+ /lib/init/apparmor-profile-load usr.sbin.cupsd
/sbin/apparmor_parser: Unable to replace "/usr/lib/cups/backend/cups-pdf". Profile doesn't conform to protocol
Warning failed to create cache: usr.sbin.cupsd

affects: cups (Ubuntu) → apparmor (Ubuntu)
Changed in apparmor (Ubuntu):
status: Incomplete → New
summary: - package cups 1.5.2-8bzr2 failed to install/upgrade: Unterprozess
- installiertes post-installation-Skript gab den Fehlerwert 1 zurück
+ apparmor_parser: Unable to replace "/usr/lib/cups/backend/cups-pdf".
+ Profile doesn't conform to protocol
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in apparmor (Ubuntu):
status: New → Confirmed
John Johansen (jjohansen) wrote :

I notice you are not using the precise kernel but instead
  Linux 3.3.0-09248-g1338631 x86_64

Can you attach the following information
  .config file for the kernel in use
  Any additional information about this 3.3 kernel that might be relevant, patches applied, etc.

  The output of
    apparmor_parser -V
    ls -R /sys/kernel/security/apparmor/

The debug.file generate by
    apparmor_parser -QT -o debug.file usr.sbin.cupsd

Hello,

I use this kernel: 3.4.0-999-generic #201204010405 not 3.3.0

2012-04-02 22:25 keltezéssel, John Johansen írta:
> I notice you are not using the precise kernel but instead
> Linux 3.3.0-09248-g1338631 x86_64
>
> Can you attach the following information
> .config file for the kernel in use
> Any additional information about this 3.3 kernel that might be relevant, patches applied, etc.
>
> The output of
> apparmor_parser -V
> ls -R /sys/kernel/security/apparmor/
>
> The debug.file generate by
> apparmor_parser -QT -o debug.file usr.sbin.cupsd
>

Oleksij Rempel (olerem) wrote :

I use clean master branch from kernel.org

i also did some testing and this problem was introduced by some patch between v3.3 and v3.3.0-09248-g1338631. v3.4.0-rc1-00104-g7d6e1cb is still effected. Today i will probably have no time for bisecting.

=====================================
apparmor_parser -V
AppArmor parser version 2.7.102
Copyright (C) 1999-2008 Novell Inc.
Copyright 2009-2012 Canonical Ltd.

=====================================
ls -R /sys/kernel/security/apparmor/
/sys/kernel/security/apparmor/:
features

/sys/kernel/security/apparmor/features:
capability domain file rlimit

/sys/kernel/security/apparmor/features/domain:
change_hat change_hatv change_onexec change_profile

/sys/kernel/security/apparmor/features/file:
mask

/sys/kernel/security/apparmor/features/rlimit:
mask

Oleksij Rempel (olerem) wrote :
Oleksij Rempel (olerem) wrote :
John Johansen (jjohansen) wrote :

Thanks Oleksij

I know what the problem is, and we should have a test apparmor_parser available for you to try in a couple hours

Changed in apparmor (Ubuntu):
importance: Undecided → High
milestone: none → ubuntu-12.04
Changed in apparmor (Ubuntu):
importance: High → Critical
dino99 (9d9) wrote :

Have resolved the same issue on Precise by installing appmenu-indicator

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apparmor - 2.7.102-0ubuntu3

---------------
apparmor (2.7.102-0ubuntu3) precise; urgency=low

  [ Jamie Strandboge ]
  * debian/patches/0007-ubuntu-manpage-updates.patch: update apparmor(5)
    to describe Ubuntu's two-stage policy load and how to add utilize it
    when developing policy (LP: #974089)

  [ Serge Hallyn ]
  * debian/apparmor.init: do nothing in a container. This can be
    removed once stacked profiles are supported and used by lxc.
    (LP: #978297)

  [ Steve Beattie ]
  * debian/patches/0008-apparmor-lp963756.patch: Fix permission mapping
    for change_profile onexec (LP: #963756)
  * debian/patches/0009-apparmor-lp959560-part1.patch,
    debian/patches/0010-apparmor-lp959560-part2.patch: Update the parser
    to support the 'in' keyword for value lists, and make mount
    operations aware of 'in' keyword so they can affect the flags build
    list (LP: #959560)
  * debian/patches/0011-apparmor-lp872446.patch: fix logprof missing
    exec events in complain mode (LP: #872446)
  * debian/patches/0012-apparmor-lp978584.patch: allow inet6 access in
    dovecot imap-login profile (LP: #978584)
  * debian/patches/0013-apparmor-lp800826.patch: fix libapparmor
    log parsing library from dropping apparmor network events that
    contain ip addresses or ports in them (LP: #800826)
  * debian/patches/0014-apparmor-lp979095.patch: document new mount rule
    syntax and usage in apparmor.d(5) manpage (LP: #979095)
  * debian/patches/0015-apparmor-lp963756.patch: Fix change_onexec
    for profiles without attachment specification (LP: #963756,
    LP: #978038)
  * debian/patches/0016-apparmor-lp968956.patch: Fix protocol error when
    loading policy to kernels without compat patches (LP: #968956)
  * debian/patches/0017-apparmor-lp979135.patch: Fix change_profile to
    grant access to /proc/attr api (LP: #979135)
 -- Steve Beattie <email address hidden> Thu, 12 Apr 2012 06:17:42 -0500

Changed in apparmor (Ubuntu):
status: Confirmed → Fix Released
To post a comment you must log in.