Apparmor error failed to start profiles

[Lee Young]

OS Ubuntu focal fossa 20.04
On boot error message - Apparmor Failed to start profiles.

Steps attempted to correct

1.sudo as status

lee@lee-desktop:~$ sudo aa-status
apparmor module is loaded.
53 profiles are loaded.
51 profiles are in enforce mode.
   /sbin/dhclient
   /snap/core/8268/usr/lib/snapd/snap-confine
   /snap/core/8268/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/evince
   /usr/bin/evince-previewer
   /usr/bin/evince-previewer//sanitized_helper
   /usr/bin/evince-thumbnailer
   /usr/bin/evince//sanitized_helper
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/cups/backend/cups-pdf
   /usr/lib/lightdm/lightdm-guest-session
   /usr/lib/lightdm/lightdm-guest-session//chromium
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/lib/telepathy/mission-control-5
   /usr/lib/telepathy/telepathy-*
   /usr/lib/telepathy/telepathy-*//pxgsettings
   /usr/lib/telepathy/telepathy-*//sanitized_helper
   /usr/lib/telepathy/telepathy-ofono
   /usr/sbin/cups-browsed
   /usr/sbin/cupsd
   /usr/sbin/cupsd//third_party
   /usr/sbin/ippusbxd
   /usr/sbin/tcpdump
   /usr/share/hplip/plugin.py
   /usr/share/hplip/sendfax.py
   /usr/share/hplip/setup.py
   /usr/share/hplip/systray.py
   /usr/share/hplip/toolbox.py
   libreoffice-senddoc
   libreoffice-soffice//gpg
   libreoffice-xpdfimport
   lsb_release
   man_filter
   man_groff
   nvidia_modprobe
   nvidia_modprobe//kmod
   snap-update-ns.core
   snap-update-ns.gnome-calculator
   snap-update-ns.gnome-characters
   snap-update-ns.gnome-logs
   snap-update-ns.gnome-system-monitor
   snap.core.hook.configure
   snap.gnome-calculator.gnome-calculator
   snap.gnome-characters.gnome-characters
   snap.gnome-logs.gnome-logs
   snap.gnome-system-monitor.gnome-system-monitor
   system_tor
2 profiles are in complain mode.
   libreoffice-oopslash
   libreoffice-soffice
3 processes have profiles defined.
3 processes are in enforce mode.
   /usr/lib/telepathy/mission-control-5 (3090)
   /usr/sbin/cupsd (1646)
   /usr/bin/tor (1861) system_tor
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
lee@lee-desktop:~$

2.sudo /etc/init.d/apparmor restart

lee@lee-desktop:~$ sudo /etc/init.d/apparmor restart
Restarting apparmor (via systemctl): apparmor.serviceJob for apparmor.service failed because the control process exited with error code.
See "systemctl status apparmor.service" and "journalctl -xe" for details.
 failed!
lee@lee-desktop:~$

3.sudo rm -rf /etc/apparmor.d/cache/*

4. sudo /etc/init.d/apparmor restart

lee@lee-desktop:~$ sudo /etc/init.d/apparmor restart
Restarting apparmor (via systemctl): apparmor.serviceJob for apparmor.service failed because the control process exited with error code.
See "systemctl status apparmor.service" and "journalctl -xe" for details.
 failed!
lee@lee-desktop:~$

Thanks,

Lee

ProblemType: Bug
DistroRelease: Ubuntu 20.04
Package: apparmor 2.13.3-7ubuntu1
ProcVersionSignature: Ubuntu 5.4.0-12.15-generic 5.4.8
Uname: Linux 5.4.0-12-generic x86_64
ApportVersion: 2.20.11-0ubuntu15
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Tue Jan 28 23:19:19 2020
InstallationDate: Installed on 2013-08-08 (2365 days ago)
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Release amd64 (20120425)
ProcEnviron:
 TERM=xterm-256color
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcKernelCmdline: BOOT_IMAGE=/boot/vmlinuz-5.4.0-12-generic root=UUID=d2e1abc4-e044-467e-8cc2-57cbe4ef3115 ro drm.debug=0xe plymouth:debug
SourcePackage: apparmor
UpgradeStatus: No upgrade log present (probably fresh install)

[Christian Boltz (cboltz)]

I'm afraid the logs you attached don't include anything about the reason why you get this failure. Can you please attach the output of

systemctl status -n200 apparmor.service

[Launchpad Janitor (janitor)]

[Expired for apparmor (Ubuntu) because there has been no activity for 60 days.]

[Sven (5-launmhpad-t)]

● apparmor.service - Load AppArmor profiles
     Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Thu 2020-05-21 20:56:02 CEST; 3min 38s ago
       Docs: man:apparmor(7)
             https://gitlab.com/apparmor/apparmor/wikis/home/
    Process: 7127 ExecStart=/lib/apparmor/apparmor.systemd reload (code=exited, status=1/FAILURE)
   Main PID: 7127 (code=exited, status=1/FAILURE)

No further hint, what's wrong...

[Christian Boltz (cboltz)]

Indeed, that's not really helpful :-(

Another idea - does

    apparmor_parser -r /etc/apparmor.d/

print any output? (If yes, please paste or attach it.)

[Michal Petřek (ersaf)]

I found the same issue in my dmesg output.
Here is outupt of suggested command

    # apparmor_parser -r /etc/apparmor.d/
    AppArmor parser error for /etc/apparmor.d/ in profile /etc/apparmor.d//usr.sbin.cups-browsed at
    line 23: syntax error, unexpected TOK_CLOSE, expecting TOK_ID or TOK_END_OF_RULE
    Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd

[Christian Boltz (cboltz)]

Looks like the profile for cups-browsed has a syntax error. (Did you change something in the profile, or is it the original profile as shipped in the package?)

Also, AFAIK this profile is shipped with the cups package, therefore I'm adding that package.