Ubuntu
apparmor package

Can not load mysql-akonadi apparmor profile

Bug #1440501 reported by Benedikt
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
akonadi (Ubuntu)
Fix Released
High
Unassigned
apparmor (Ubuntu)
Invalid
High
Unassigned

Bug Description

Apparmor fails to start witch exit code 123, because it can not load the mysql-akonadi profile:

% sudo systemctl status apparmor -l
● apparmor.service - LSB: AppArmor initialization
   Loaded: loaded (/etc/init.d/apparmor)
   Active: failed (Result: exit-code) since So 2015-04-05 12:29:33 CEST; 55s ago
     Docs: man:systemd-sysv-generator(8)
  Process: 13906 ExecStart=/etc/init.d/apparmor start (code=exited, status=123)

Apr 05 12:29:33 benediktZ50-70 apparmor[13906]: Skipping profile in /etc/apparmor.d/disable: usr.bin.firefox
Apr 05 12:29:33 benediktZ50-70 apparmor[13906]: AppArmor parser error for /etc/apparmor.d/usr.sbin.mysqld-akonadi in /etc/apparmor.d/usr.sbin.mysqld-akonadi at line 31: Could not open 'local/usr.sbin.mysqld-akonadi'
Apr 05 12:29:33 benediktZ50-70 apparmor[13906]: Skipping profile in /etc/apparmor.d/disable: usr.bin.firefox
Apr 05 12:29:33 benediktZ50-70 apparmor[13906]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
Apr 05 12:29:33 benediktZ50-70 apparmor[13906]: AppArmor parser error for /etc/apparmor.d/usr.sbin.mysqld-akonadi in /etc/apparmor.d/usr.sbin.mysqld-akonadi at line 31: Could not open 'local/usr.sbin.mysqld-akonadi'
Apr 05 12:29:33 benediktZ50-70 apparmor[13906]: ...fail!
Apr 05 12:29:33 benediktZ50-70 systemd[1]: apparmor.service: control process exited, code=exited status=123
Apr 05 12:29:33 benediktZ50-70 systemd[1]: Failed to start LSB: AppArmor initialization.
Apr 05 12:29:33 benediktZ50-70 systemd[1]: Unit apparmor.service entered failed state.
Apr 05 12:29:33 benediktZ50-70 systemd[1]: apparmor.service failed.

However Apparmor loaded successfully:

% sudo aa-status
apparmor module is loaded.
17 profiles are loaded.
17 profiles are in enforce mode.
   /sbin/dhclient
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/cups/backend/cups-pdf
   /usr/lib/libvirt/virt-aa-helper
   /usr/lib/telepathy/mission-control-5
   /usr/lib/telepathy/telepathy-*
   /usr/lib/telepathy/telepathy-*//pxgsettings
   /usr/lib/telepathy/telepathy-*//sanitized_helper
   /usr/lib/telepathy/telepathy-ofono
   /usr/sbin/cups-browsed
   /usr/sbin/cupsd
   /usr/sbin/cupsd//third_party
   /usr/sbin/libvirtd
   /usr/sbin/tcpdump
   docker-default
0 profiles are in complain mode.
5 processes have profiles defined.
5 processes are in enforce mode.
   /sbin/dhclient (11821)
   /usr/lib/telepathy/mission-control-5 (2008)
   /usr/sbin/cups-browsed (840)
   /usr/sbin/cupsd (12783)
   /usr/sbin/libvirtd (971)
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

It is really necessary to set Apparmor as failed if one profile could not be loaded?

Benedikt (benedikt-klotz)
tags: added: kubuntu vivid
summary: - Can not load mysql-akonadi profile
+ Can not load mysql-akonadi apparmor profile
Benedikt (benedikt-klotz)
tags: added: systemd-boot
Martin Pitt (pitti)
tags: removed: systemd-boot
Revision history for this message
Martin Tang (infinitesimal) wrote :

Putting a file in /etc/apparmor.d/local/usr.sbin.mysqld-akonadi (like the other examples already there) resolves the issue. Maybe the packaging for akonadi-backend-mysql forgot to generate an empty configuration file there?

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in akonadi (Ubuntu):
status: New → Confirmed
Changed in apparmor (Ubuntu):
status: New → Confirmed
Alberto Salvia Novella (es20490446e)
Changed in akonadi (Ubuntu):
importance: Undecided → High
Changed in apparmor (Ubuntu):
importance: Undecided → High
Revision history for this message
Steve Beattie (sbeattie) wrote :

For some reason, the dh-apparmor hook invocation in the akonadi package is not causing the postinst script to be created for the akonadi-backend-mysql package that would create the /etc/apparmor.d/local/usr.sbin.mysqld-akonadi file on package installation, despite the dh-apparmor script calling autoscript() for this precise reason.

Revision history for this message
Steve Beattie (sbeattie) wrote :

Ah, this merge http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/vivid/akonadi/vivid-proposed/revision/102#debian/rules disabled the override_dh_installinit: target in debian/rules, preventing dh-apparmor from generating the postinst script that would create /etc/apparmor.d/local/usr.sbin.mysqld-akonadi at package install time.

Revision history for this message
Steve Beattie (sbeattie) wrote :

The attached debdiff fixes the issue.

Changed in apparmor (Ubuntu):
status: Confirmed → Invalid
Philip Muškovac (yofel)
Changed in akonadi (Ubuntu):
status: Confirmed → Fix Committed
Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "akonadi_1.13.0-2ubuntu4.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

tags: added: patch
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package akonadi - 1.13.0-2ubuntu4

---------------
akonadi (1.13.0-2ubuntu4) vivid; urgency=medium

  * debian/rules: re-enable the override_dh_installinit target, disabled
    in an earlier merge from debian. This allows dh-apparmor to create
    the postinst for the akonadi-backend-mysql package, which creates
    the missing part of that package's apparmor profile at install time
    (LP: #1440501)
 -- Steve Beattie <email address hidden> Wed, 15 Apr 2015 10:48:33 -0700

Changed in akonadi (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.