Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I use apparmor together with libapache2-mod-apparmor to sandbox some websites. However After a recent reinstall it stopped working. I keep getting this error:

Setting up apparmor (2.7.0~beta1+bzr1774-1ubuntu2) ...
 * Starting AppArmor profiles
Warning from stdin (line 1): /sbin/apparmor_parser: cannot use or update cache, disable, or force-complain via stdin

[ OK ]
 * Reloading AppArmor profiles
Warning from stdin (line 1): /sbin/apparmor_parser: cannot use or update cache, disable, or force-complain via stdin
invoke-rc.d: initscript apparmor, action "reload" failed.

I tried to completely remove and purge apparmor, apache2, libapache2-mod-apparmor etc, and then reinstall, but I keep getting this error. As far as I know there is nothing else on the system that could be preventing it. Any ideas?

share|improve this question

1 Answer 1

AppArmor fails to generate or update cache files when the features reported by the kernel and those in the cache are out of sync. This can happen when a kernel with new features is installed and/or the userspace has not been updated to match and/or there is a bug in the userspace compiler.

One way to get in this situation is by installing a kernel from a development release, or from upstream and not also updating the apparmor userspace with matching packages. This does not stop apparmor from loading policy but it does generate warnings and slow it down as it does a new compile on each load.

Removing and reinstalling a set of packages like apparmor, apache2, libapache2, .. may or may not correctly remove and clean out old inconsistent cache file. The partial removal of cache files will generally result in new cache entries not being generated as the cache only stores entries for one features set.

The cache files are stored in /etc/apparmor.d/cache/

You can compare the cache and kernel features sets by looking at /etc/apparmor.d/cache/.features and depending on your kernel /sys/kernel/security/apparmor/features/ (a directory of entries) or /sys/kernel/security/apparmor/features (a file) and /sys/kernel/security/apparmor/matching

You can check for loaded policy status, to determine if policy is being loaded and its just cache update failures you are experiencing by using sudo aa-status

you can try to force regenerating the cache by using sudo /etc/init.d/apparmor restart

if that fails you can try manual removing the the cache files and then regenerating the cache sudo rm -rf /etc/apparmor.d/cache/* sudo /etc/init.d/apparmor restart

If that doesn't work you have hit a bug and I would recommend filing a bug with launchpad ubuntu-bug apparmor

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.