Failed to start AppArmor initialization with status=123/n/a

Another user reported what sounds like the same issue at https://ubuntuforums.org/showthread.php?t=2386129&p=13749658#post13749658

Hello Rocko,

Can you try the following?

sudo apparmor_parser --replace /etc/apparmor.d/usr.bin.webbrowser-app
sudo apparmor_parser --replace /etc/apparmor.d/usr.lib.mediascanner-2.0.mediascanner-extractor

Thanks

I get this:

$ sudo apparmor_parser --replace /etc/apparmor.d/usr.bin.webbrowser-app
AppArmor parser error for /etc/apparmor.d/usr.bin.webbrowser-app in /etc/apparmor.d/usr.bin.webbrowser-app at line 26: Could not open '/usr/share/apparmor/hardware/graphics.d'

$ sudo apparmor_parser --replace /etc/apparmor.d/usr.lib.mediascanner-2.0.mediascanner-extractor
AppArmor parser error for /etc/apparmor.d/usr.lib.mediascanner-2.0.mediascanner-extractor in /etc/apparmor.d/usr.lib.mediascanner-2.0.mediascanner-extractor at line 14: Could not open '/usr/share/apparmor/hardware/audio.d'

FWIW, I don't actually have a /usr/share/apparmor folder.

Would these errors prevent apparmor from running at all?

No, the script is returning non-zero because some of the profiles didn't load, but the rest of the profiles will load fine. You can prove this to yourself using 'sudo aa-status'.

As for those two profiles, the come from https://launchpad.net/ubuntu/+source/webbrowser-app/ and https://launchpad.net/ubuntu/+source/mediascanner2/, both of which have been removed from 18.04. It sounds like these packages are still installed on you system, you can remove them with:

$ sudo apt-get remove --purge webbrowser-app mediascanner2.0

This isn't really a bug in apparmor-- the profiles weren't purged from the system. We could perhaps add a Conflicts on webbrowser-app mediascanner2.0 to apparmor, but that doesn't feel right (and wouldn't remove the conffiles anyway (so this bug would remain)). Perhaps ubuntu-release-upgrader could be modified to remove the files on upgrade... adding a task for that.

Thanks, removing the packages makes the errors go away.

Do you think the error message is misleading? Instead of saying "Failed to start AppArmor initialization", perhaps it should say, "Failed to load some profiles"?

On Wed, Mar 21, 2018 at 12:46:04AM -0000, Rocko wrote:
> Thanks, removing the packages makes the errors go away.

Good, I'm glad to hear this worked.

> Do you think the error message is misleading? Instead of saying "Failed
> to start AppArmor initialization", perhaps it should say, "Failed to
> load some profiles"?

This error message is provided by systemd: "Failed to start" followed
by the Description field from the service file. There's no mechanism to
customize the message on success vs failure.

Thanks

Status changed to 'Confirmed' because the bug affects multiple users.

Infinity suggests:

- Versioned breaks from apparmor against the other two packages
- Using the apparmor maintainer scripts to remove the conffiles

Thanks

media-hub is another application that was removed in bionic that is affected.

Uploaded 2.12-4ubuntu3 to address this.

$ diff -u <(grep etc/apparmor.d Contents-xenial | awk '{print $1}') <(grep etc/apparmor.d Contents-bionic | awk '{print $1}')
--- /dev/fd/63 2018-04-03 17:45:57.438698038 -0700
+++ /dev/fd/62 2018-04-03 17:45:57.438698038 -0700
@@ -23,16 +23,19 @@
 etc/apparmor.d/abstractions/enchant
 etc/apparmor.d/abstractions/evince
 etc/apparmor.d/abstractions/fcitx
+etc/apparmor.d/abstractions/fcitx-strict
 etc/apparmor.d/abstractions/fonts
 etc/apparmor.d/abstractions/freedesktop.org
 etc/apparmor.d/abstractions/gnome
 etc/apparmor.d/abstractions/gnupg
 etc/apparmor.d/abstractions/gstreamer
+etc/apparmor.d/abstractions/i2p
 etc/apparmor.d/abstractions/ibus
 etc/apparmor.d/abstractions/kde
 etc/apparmor.d/abstractions/kerberosclient
 etc/apparmor.d/abstractions/launchpad-integration
 etc/apparmor.d/abstractions/ldapclient
+etc/apparmor.d/abstractions/libpam-systemd
 etc/apparmor.d/abstractions/libvirt-lxc
 etc/apparmor.d/abstractions/libvirt-qemu
 etc/apparmor.d/abstractions/lightdm
@@ -42,7 +45,8 @@
 etc/apparmor.d/abstractions/lxc/start-container
 etc/apparmor.d/abstractions/mdns
 etc/apparmor.d/abstractions/mir
-etc/apparmor.d/abstractions/mozc_server
+etc/apparmor.d/abstractions/mozc
+etc/apparmor.d/abstractions/mozc-server
 etc/apparmor.d/abstractions/mysql
 etc/apparmor.d/abstractions/nameservice
 etc/apparmor.d/abstractions/nis
@@ -51,6 +55,7 @@
 etc/apparmor.d/abstractions/orbit2
 etc/apparmor.d/abstractions/p11-kit
 etc/apparmor.d/abstractions/perl
+etc/apparmor.d/abstractions/php
 etc/apparmor.d/abstractions/php5
 etc/apparmor.d/abstractions/postfix-common
 etc/apparmor.d/abstractions/private-files
@@ -94,23 +99,25 @@
 etc/apparmor.d/abstractions/user-tmp
 etc/apparmor.d/abstractions/user-write
 etc/apparmor.d/abstractions/video
+etc/apparmor.d/abstractions/wayland
 etc/apparmor.d/abstractions/web-data
 etc/apparmor.d/abstractions/winbind
 etc/apparmor.d/abstractions/wutmp
 etc/apparmor.d/abstractions/xad
 etc/apparmor.d/abstractions/xdg-desktop
+etc/apparmor.d/apache2.d/kopano-webapp
 etc/apparmor.d/apache2.d/phpsysinfo
 etc/apparmor.d/bin.ping
-etc/apparmor.d/content-hub-testability
 etc/apparmor.d/dhcpd.d/maas
+etc/apparmor.d/firejail-default
 etc/apparmor.d/gst_plugin_scanner
 etc/apparmor.d/libvirt/TEMPLATE.lxc
 etc/apparmor.d/libvirt/TEMPLATE.qemu
 etc/apparmor.d/lightdm-guest-session
+etc/apparmor.d/lightdm-remote-session-x2go
 etc/apparmor.d/local/README
+etc/apparmor.d/local/firejail-local
 etc/apparmor.d/local/usr.sbin.apache2
-etc/apparmor.d/local/usr.sbin.libvirtd
-etc/apparmor.d/local/usr.sbin.named
 etc/apparmor.d/lxc-containers
 etc/apparmor.d/lxc/lxc-default
 etc/apparmor.d/lxc/lxc-default-cgns
@@ -118,40 +125,43 @@
 etc/apparmor.d/lxc/lxc-default-with-nesting
 etc/apparmor.d/sbin.aprx
 etc/apparmor.d/sbin.dhclient
+etc/apparmor.d/sbin.dhcpcanon
 etc/apparmor.d/sbin.klogd
 etc/apparmor.d/sbin.syslog-ng
 etc/apparmor.d/sbin.syslogd
+etc/apparmor.d/system_i2p
 etc/apparmor.d/system_tor
 etc/apparmor.d/tunables/alias
 etc/apparmor.d/tunables/apparmorfs
 etc/apparmor.d/tunables/dovecot
 etc/apparmor.d/tunables/global
 etc/apparmor.d/tunables/home
+etc/apparmor.d/tunables/home.d/site.local
 etc/apparmor.d/tunables/kernelvars
 etc/app...

Do we need to worry about:

ubuntu-download-manager: /etc/apparmor.d/usr.lib.ubuntu-download-manager.udm-extractor
messaging-app: /etc/apparmor.d/usr.bin.messaging-app
content-hub-testability: /etc/apparmor.d/content-hub-testability

Thanks

This bug was fixed in the package apparmor - 2.12-4ubuntu3

---------------
apparmor (2.12-4ubuntu3) bionic; urgency=medium

  * Remove old Ubuntu Touch profiles for packages removed from the archive
    since they need apparmor-easyprof-ubuntu to compile, and it was also
    removed from the archive (LP: #1756800)
    - debian/control: Breaks on media-hub, mediascanner2.0 and webbrowser-app
    - debian/postinst: on upgrade, remove profiles for usr.bin.webbrowser-app,
      usr.bin.media-hub-server, usr.lib.mediascanner-2.0.mediascanner-extractor
      and usr.bin.mediascanner-service-2.0

 -- Jamie Strandboge <email address hidden> Tue, 03 Apr 2018 13:12:46 +0000

"Do we need to worry about:

ubuntu-download-manager: /etc/apparmor.d/usr.lib.ubuntu-download-manager.udm-extractor
messaging-app: /etc/apparmor.d/usr.bin.messaging-app
content-hub-testability: /etc/apparmor.d/content-hub-testability
"

Yes. I did an archive grep and found media-hub, but that grep didn't find these since they generate the profile from debian/rules. I'm running a new grep to catch that and will update apparmor accordingly.

Actually, only messaging-app is affected by this bug, so we don't need to remove the other two.

https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1761176 filed for messaging-app.

I have a similar issue, getting these messages from apparmor:

May 28 06:52:02 bureau apparmor[993]: AppArmor parser error for /etc/apparmor.d/usr.sbin.nscd in /etc/apparmor.d/tunables/multiarch at line 13: syntax error, unexpected TOK_EQUALS, expecting TOK_OPEN
May 28 06:52:02 bureau apparmor[993]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
May 28 06:52:02 bureau apparmor[993]: AppArmor parser error for /etc/apparmor.d/usr.sbin.smbd in /etc/apparmor.d/tunables/multiarch at line 13: syntax error, unexpected TOK_EQUALS, expecting TOK_OPEN
May 28 06:52:02 bureau apparmor[993]: AppArmor parser error for /etc/apparmor.d/usr.sbin.smbldap-useradd in /etc/apparmor.d/tunables/multiarch at line 13: syntax error, unexpected TOK_EQUALS, expecting TOK
May 28 06:52:02 bureau apparmor[993]: AppArmor parser error for /etc/apparmor.d/usr.sbin.tcpdump in /etc/apparmor.d/tunables/multiarch at line 13: syntax error, unexpected TOK_EQUALS, expecting TOK_OPEN
May 28 06:52:02 bureau apparmor[993]: AppArmor parser error for /etc/apparmor.d/usr.sbin.traceroute in /etc/apparmor.d/tunables/multiarch at line 13: syntax error, unexpected TOK_EQUALS, expecting TOK_OPEN
May 28 06:52:02 bureau apparmor[993]: ...fail!

However, I think the error is deeper than some faulty profiles because no profiles get loaded at all:

> sudo aa-status
apparmor module is loaded.
0 profiles are loaded.
0 profiles are in enforce mode.
0 profiles are in complain mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

Does anybody have a suggestion for how to investigate further?

Looks like you have a syntax error in /etc/apparmor.d/tunables/multiarch around line 13. Can you please attach this file? Also, did you modify it manually?

This may be a dumb question, but once we *have* this bug, how do we fix it? I'm not that practiced at apparmor.

Ron, you look at the profiles that failed to compile/load in the journalctl -u apparmor output, and decide what to do with those profiles -- if they are for programs that no longer exist because the package has since been removed, you can just delete the profile file. If they are for programs that you use, then you should fix whatever error is in the profile.

More details would require more details. Consider filing a new bug if you've got this error with profiles that were provided by a package.

Thanks