13

Apparmor fails boot and command line start with same result as below

x@x-NICEPUTER:~$ systemctl --failed
  UNIT             LOAD   ACTIVE SUB    DESCRIPTION
● apparmor.service loaded failed failed LSB: AppArmor initialization

LOAD   = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB    = The low-level unit activation state, values depend on unit type.

1 loaded units listed. Pass --all to see loaded but inactive units, too.
To show all installed unit files use 'systemctl list-unit-files'.

x@x-NICEPUTER:~$ systemctl status apparmor.service
● apparmor.service - LSB: AppArmor initialization
   Loaded: loaded (/etc/init.d/apparmor; bad; vendor preset: enabled)
   Active: failed (Result: exit-code) since Tue 2016-05-03 21:52:29 MDT; 1h 15min ago
     Docs: man:systemd-sysv-generator(8)
  Process: 523 ExecStart=/etc/init.d/apparmor start (code=exited, status=123)

May 03 21:52:22 x-NICEPUTER apparmor[523]: AppArmor parser error for /etc/apparmor.d/usr.bin.webbrowser-app in /etc/apparmor.d/usr.bin.webbrowser-app at line 26: Could not open '/usr/share/apparmor/hardware/graphics.d'
May 03 21:52:28 x-NICEPUTER apparmor[523]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
May 03 21:52:29 x-NICEPUTER apparmor[523]: Skipping profile in /etc/apparmor.d/disable: usr.bin.firefox
May 03 21:52:29 x-NICEPUTER apparmor[523]: AppArmor parser error for /etc/apparmor.d/usr.bin.webbrowser-app in /etc/apparmor.d/usr.bin.webbrowser-app at line 26: Could not open '/usr/share/apparmor/hardware/graphics.d'
May 03 21:52:29 x-NICEPUTER apparmor[523]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
May 03 21:52:29 x-NICEPUTER apparmor[523]:    ...fail!
May 03 21:52:29 x-NICEPUTER systemd[1]: apparmor.service: Control process exited, code=exited status=123
May 03 21:52:29 x-NICEPUTER systemd[1]: Failed to start LSB: AppArmor initialization.
May 03 21:52:29 x-NICEPUTER systemd[1]: apparmor.service: Unit entered failed state.
May 03 21:52:29 x-NICEPUTER systemd[1]: apparmor.service: Failed with result 'exit-code'.

Directories apparmor/hardware/ and file graphics.d do not exist inside /usr/share/ Thus #include /usr/share/apparmor/hardware/graphics.d at line 26 of /etc/apparmor.d/usr.bin.webbrowser-app returns null and causes the failure.

How can I properly fix this or at the least create a workaround that allows apparmor.service to intialize without a failure?

uname -a
Linux x-NICEPUTER 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
sudo lshw
[sudo] password for x: 
x-niceputer               
    description: Computer
    width: 64 bits
    capabilities: smbios-2.4 vsyscall32
  *-core
       description: Motherboard
       physical id: 0
     *-memory
          description: System memory
          physical id: 0
          size: 3793MiB
     *-cpu
          product: Intel(R) Core(TM)2 Duo CPU     P8400  @ 2.26GHz
18

Seems to be a reported bug (#1554803)

It can be solved installing apparmor-easyprof-ubuntu or creating the folders by hand.

sudo apt-get install apparmor-easyprof-ubuntu
4
  • Would you mind expanding your answer and providing the proper steps to install the package you are referring to or to create the necessary folders. I looked at the bug it is indeed the same I see. Thank you :) May 4 '16 at 22:54
  • how this solving this problem ? Feb 27 '17 at 23:42
  • 1
    @EbuzerTahaKANAT I don't think this solves the AppArmor problem but provides a way to keep systemd from failing AppArmor initialization on boot. I built the folders and empty files by hand and, I ran the installation of apparmor-easyprof-ubuntu. Files (video.d, graphics.d, and audio.d) are still empty in my system and boot no longer records a fail code. These files are supposed to contain AppArmor policy code, I think, its a guess based on first line here launchpad.net/apparmor-easyprof-ubuntu Not sure if Apparmor protects these devices? Bug still open! Apr 12 '17 at 19:13
  • For me, I was unable to install any package because ifconfig and network-manager would not load (I have a USB wifi dongle). So @xtrchessreal 's suggestion is what worked.
    – midopa
    Dec 13 '17 at 6:14
3

In my case the problem appeared when I uninstalled the snapd package with apt-get remove snapd. Checking the syslog, it seems the snapd uninstaller deleted some directories but not the apparmor config files referencing them. I pruned the package with apt-get purge snapd and restarted apparmor without errors.

1

For me, I couldn't install any packages because both ifconfig and network-manager could not find/start my USB wifi dongle.

So @xtrchessreal's comment is what worked for me:

In the recovery mode shell, create the following directories:

mkdir -p /usr/share/apparmor/hardware/graphics.d
mkdir -p /usr/share/apparmor/hardware/audio.d
mkdir -p /usr/share/apparmor/hardware/video.d

And then reboot

2
  • apparmor-easyprof-ubuntu IMPORTANT: this project is no longer actively maintained by the Ubuntu Security team of Canonical. Per launchpad.net/apparmor-easyprof-ubuntu I wonder if it maintained elsewhere? Dec 13 '17 at 20:34
  • Good to know! I'm just going to remove it from the answer then.
    – midopa
    Dec 25 '17 at 8:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.