Your message dated Tue, 01 Apr 2025 21:44:56 +0200 with message-id <[email protected]> and subject line Re: apparmor-profiles: chromium-browser profile removal ok but does not automatically restart apparmor with fixed profiles has caused the Debian Bug report #1101066, regarding apparmor-profiles: chromium-browser profile removal ok but does not automatically restart apparmor with fixed profiles to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 1101066: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1101066 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: apparmor-profiles Version: 4.1.0~beta5-5 Severity: normal Dear Maintainer, Following the bug report about the spurious chromium-browser profile from 2016 breaking apparmor years later due to the removal of hte chromium-browser abstraction a month ago, I tested the fixed package. The new apparmor-profiles 4.1.0~beta5-5 properly remove the broken profile but does not restart the apparmor service afterwards thus leaves the service down even if all the profiles are now fine. Before: " systemctl status apparmor × apparmor.service - Load AppArmor profiles Loaded: loaded (/usr/lib/systemd/system/apparmor.service; enabled; preset: enabled) Active: failed (Result: exit-code) since Fri 2025-03-21 23:30:50 CET; 21h ago Duration: 2d 4h 8min 17.377s Invocation: c79a1ba7950048b6b33356602ee5da7f Docs: man:apparmor(7) https://gitlab.com/apparmor/apparmor/wikis/home/ Main PID: 541376 (code=exited, status=1/FAILURE) Mem peak: 15.5M CPU: 862ms mars 21 23:30:49 cyclope systemd[1]: Starting apparmor.service - Load AppArmor profiles... mars 21 23:30:49 cyclope apparmor.systemd[541376]: Restarting AppArmor mars 21 23:30:49 cyclope apparmor.systemd[541376]: Reloading AppArmor profiles mars 21 23:30:50 cyclope apparmor.systemd[541492]: Erreur de l'analyseur AppArmor pour /etc/apparmor.d in profile /etc/apparmor.d/usr.bin.chromium-browser ? la ligne 17 : Impossible d'ouvrir << abstractions/ubu> mars 21 23:30:50 cyclope apparmor.systemd[541502]: Skipping profile in /etc/apparmor.d/disable: usr.bin.thunderbird mars 21 23:30:50 cyclope apparmor.systemd[541516]: Skipping profile in /etc/apparmor.d/disable: usr.local.sbin.vnoded mars 21 23:30:50 cyclope apparmor.systemd[541376]: Error: At least one profile failed to load mars 21 23:30:50 cyclope systemd[1]: apparmor.service: Main process exited, code=exited, status=1/FAILURE mars 21 23:30:50 cyclope systemd[1]: apparmor.service: Failed with result 'exit-code'. mars 21 23:30:50 cyclope systemd[1]: Failed to start apparmor.service - Load AppArmor profiles. " apparmor packages upgrade: " # apt upgrade Upgrading: apparmor apparmor-profiles cpp-12 g++-12 gcc-12-base libapparmor1 libstdc++-12-dev login.defs python3-apparmor ruby-public-suffix wine-staging wine-staging-i386:i386 apparmor-notify apparmor-utils dh-apparmor gcc-12 libapparmor-dev libgcc-12-dev libsubid5 passwd python3-libapparmor uidmap wine-staging-amd64 Summary: Upgrading: 23, Installing: 0, Removing: 0, Not Upgrading: 0 Download size: 0 B / 269 MB Space needed: 7 288 kB / 815 GB available Continue? [O/n] Récupération des rapports de bogue… Fait Analyse des informations Trouvé/Corrigé… Fait apt-listchanges : Lecture des fichiers de modifications (« changelog »)... Préconfiguration des paquets... (Lecture de la base de données... 1197085 fichiers et répertoires déjà installés.) Préparation du dépaquetage de .../wine-staging_10.4~bookworm-1_amd64.deb ... Dépaquetage de wine-staging (10.4~bookworm-1) sur (10.3~bookworm-1) ... Préparation du dépaquetage de .../wine-staging-i386_10.4~bookworm-1_i386.deb ... Dépaquetage de wine-staging-i386:i386 (10.4~bookworm-1) sur (10.3~bookworm-1) ... Préparation du dépaquetage de .../wine-staging-amd64_10.4~bookworm-1_amd64.deb ... Dépaquetage de wine-staging-amd64 (10.4~bookworm-1) sur (10.3~bookworm-1) ... Préparation du dépaquetage de .../login.defs_1%3a4.17.3-2_all.deb ... Dépaquetage de login.defs (1:4.17.3-2) sur (1:4.17.3-1) ... Paramétrage de login.defs (1:4.17.3-2) ... (Lecture de la base de données... 1197101 fichiers et répertoires déjà installés.) Préparation du dépaquetage de .../passwd_1%3a4.17.3-2_amd64.deb ... Dépaquetage de passwd (1:4.17.3-2) sur (1:4.17.3-1) ... Paramétrage de passwd (1:4.17.3-2) ... (Lecture de la base de données... 1197101 fichiers et répertoires déjà installés.) Préparation du dépaquetage de .../00-apparmor_4.1.0~beta5-5_amd64.deb ... Dépaquetage de apparmor (4.1.0~beta5-5) sur (4.1.0~beta5-4) ... Préparation du dépaquetage de .../01-apparmor-utils_4.1.0~beta5-5_all.deb ... Dépaquetage de apparmor-utils (4.1.0~beta5-5) sur (4.1.0~beta5-4) ... Préparation du dépaquetage de .../02-libapparmor-dev_4.1.0~beta5-5_amd64.deb ... Dépaquetage de libapparmor-dev:amd64 (4.1.0~beta5-5) sur (4.1.0~beta5-4) ... Préparation du dépaquetage de .../03-libapparmor1_4.1.0~beta5-5_amd64.deb ... Dépaquetage de libapparmor1:amd64 (4.1.0~beta5-5) sur (4.1.0~beta5-4) ... Préparation du dépaquetage de .../04-python3-libapparmor_4.1.0~beta5-5_amd64.deb ... Dépaquetage de python3-libapparmor (4.1.0~beta5-5) sur (4.1.0~beta5-4) ... Préparation du dépaquetage de .../05-python3-apparmor_4.1.0~beta5-5_all.deb ... Dépaquetage de python3-apparmor (4.1.0~beta5-5) sur (4.1.0~beta5-4) ... Préparation du dépaquetage de .../06-apparmor-notify_4.1.0~beta5-5_all.deb ... Dépaquetage de apparmor-notify (4.1.0~beta5-5) sur (4.1.0~beta5-4) ... Préparation du dépaquetage de .../07-apparmor-profiles_4.1.0~beta5-5_all.deb ... Dépaquetage de apparmor-profiles (4.1.0~beta5-5) sur (4.1.0~beta5-4) ... (...) Préparation du dépaquetage de .../14-dh-apparmor_4.1.0~beta5-5_all.deb ... Dépaquetage de dh-apparmor (4.1.0~beta5-5) sur (4.1.0~beta5-4) ... Préparation du dépaquetage de .../15-uidmap_1%3a4.17.3-2_amd64.deb ... Dépaquetage de uidmap (1:4.17.3-2) sur (1:4.17.3-1) ... Préparation du dépaquetage de .../16-libsubid5_1%3a4.17.3-2_amd64.deb ... Dépaquetage de libsubid5:amd64 (1:4.17.3-2) sur (1:4.17.3-1) ... Préparation du dépaquetage de .../17-ruby-public-suffix_6.0.1-1_all.deb ... Dépaquetage de ruby-public-suffix (6.0.1-1) sur (4.0.6+ds-2) ... Paramétrage de libapparmor1:amd64 (4.1.0~beta5-5) ... Paramétrage de wine-staging-amd64 (10.4~bookworm-1) ... Paramétrage de ruby-public-suffix (6.0.1-1) ... Paramétrage de libsubid5:amd64 (1:4.17.3-2) ... Paramétrage de gcc-12-base:amd64 (12.4.0-5) ... Paramétrage de apparmor (4.1.0~beta5-5) ... Reloading AppArmor profiles Erreur de l'analyseur AppArmor pour /etc/apparmor.d in profile /etc/apparmor.d/usr.bin.chromium-browser ? la ligne 17 : Impossible d'ouvrir << abstractions/ubuntu-browsers.d/chromium-browser >> Skipping profile in /etc/apparmor.d/disable: usr.bin.thunderbird Skipping profile in /etc/apparmor.d/disable: usr.local.sbin.vnoded Error: At least one profile failed to load Paramétrage de libgcc-12-dev:amd64 (12.4.0-5) ... Paramétrage de wine-staging-i386:i386 (10.4~bookworm-1) ... Paramétrage de libapparmor-dev:amd64 (4.1.0~beta5-5) ... Paramétrage de dh-apparmor (4.1.0~beta5-5) ... Paramétrage de python3-libapparmor (4.1.0~beta5-5) ... Paramétrage de cpp-12 (12.4.0-5) ... Paramétrage de apparmor-profiles (4.1.0~beta5-5) ... Paramétrage de wine-staging (10.4~bookworm-1) ... Paramétrage de libstdc++-12-dev:amd64 (12.4.0-5) ... Paramétrage de uidmap (1:4.17.3-2) ... Paramétrage de gcc-12 (12.4.0-5) ... Paramétrage de python3-apparmor (4.1.0~beta5-5) ... Paramétrage de g++-12 (12.4.0-5) ... Paramétrage de apparmor-utils (4.1.0~beta5-5) ... Paramétrage de apparmor-notify (4.1.0~beta5-5) ... Traitement des actions différées (« triggers ») pour libc-bin (2.41-6) ... Traitement des actions différées (« triggers ») pour ccache (4.10.2-1+b2) ... Updating symlinks in /usr/lib/ccache ... Traitement des actions différées (« triggers ») pour man-db (2.13.0-1) ... Traitement des actions différées (« triggers ») pour distcc (3.4+really3.4-11) ... Scanning processes... Scanning candidates... Scanning processor microcode... The processor microcode seems to be up-to-date. Restarting services... /etc/needrestart/restart.d/systemd-manager systemctl restart libvirtd.service lxc-monitord.service virtlogd.service Service restarts being deferred: /etc/needrestart/restart.d/dbus.service systemctl restart gdm.service systemctl restart systemd-logind.service No containers need to be restarted. User sessions running outdated binaries: prahal @ session #327: tmux: server[138481] prahal @ session #607: dbus-daemon[230212] prahal @ session #629: tmux: server[236725] prahal @ session #674: gdm-session-wor[288851], gdm-wayland-ses[288876] prahal @ user manager service: AgentAntidote[290100], AgentConnectix[289132], at-spi-bus-laun[288991], bash[138482,537679], gnome-keyring-d[288861], gnome-session-b[288959], gnome-shell[288990], gvfsd[288940], ibus-daemon[289103], input-leap[532230], systemd[6322], xdg-document-po[289425] No VM guests are running outdated hypervisor (qemu) binaries on this host. " After upgrade completion: " systemctl status apparmor × apparmor.service - Load AppArmor profiles Loaded: loaded (/usr/lib/systemd/system/apparmor.service; enabled; preset: enabled) Active: failed (Result: exit-code) since Fri 2025-03-21 23:30:50 CET; 21h ago Duration: 2d 4h 8min 17.377s Invocation: c79a1ba7950048b6b33356602ee5da7f Docs: man:apparmor(7) https://gitlab.com/apparmor/apparmor/wikis/home/ Main PID: 541376 (code=exited, status=1/FAILURE) Mem peak: 15.5M CPU: 862ms mars 21 23:30:49 cyclope systemd[1]: Starting apparmor.service - Load AppArmor profiles... mars 21 23:30:49 cyclope apparmor.systemd[541376]: Restarting AppArmor mars 21 23:30:49 cyclope apparmor.systemd[541376]: Reloading AppArmor profiles mars 21 23:30:50 cyclope apparmor.systemd[541492]: Erreur de l'analyseur AppArmor pour /etc/apparmor.d in profile /etc/apparmor.d/usr.bin.chromium-browser ? la ligne 17 : Impossible d'ouvrir << abstractions/ubu> mars 21 23:30:50 cyclope apparmor.systemd[541502]: Skipping profile in /etc/apparmor.d/disable: usr.bin.thunderbird mars 21 23:30:50 cyclope apparmor.systemd[541516]: Skipping profile in /etc/apparmor.d/disable: usr.local.sbin.vnoded mars 21 23:30:50 cyclope apparmor.systemd[541376]: Error: At least one profile failed to load mars 21 23:30:50 cyclope systemd[1]: apparmor.service: Main process exited, code=exited, status=1/FAILURE mars 21 23:30:50 cyclope systemd[1]: apparmor.service: Failed with result 'exit-code'. mars 21 23:30:50 cyclope systemd[1]: Failed to start apparmor.service - Load AppArmor profiles. " This issue stems from the fact the apparmor service is not restart after apparmor-profiles upgrades only after the apparmor package upgrade, and meyb even mroe to the fact apparmor installs before apparmor-profiles. I don't know if making apparmor depends on apparmor-profiles would force apt to install apparmor-profiles before upgrading the apparmor package or if the apparmor service should be restarted in the apparmor-profiles package too. Either way this might be more than a "normal" package as this can leave the apparmor secutiry disabled. Though it only affects very old setup and the fact the service is down is easely visible in the upgrade logs and in systemctl. Cheers, Alban -- System Information: Debian Release: trixie/sid APT prefers testing-debug APT policy: (500, 'testing-debug'), (500, 'stable-debug'), (500, 'oldstable-debug'), (500, 'testing'), (500, 'stable'), (90, 'unstable-debug'), (90, 'unstable'), (1, 'experimental-debug'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 6.12.17-amd64 (SMP w/4 CPU threads; PREEMPT) Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages apparmor-profiles depends on: ii apparmor 4.1.0~beta5-5 apparmor-profiles recommends no packages. apparmor-profiles suggests no packages. -- no debconf information
--- End Message ---
--- Begin Message ---Package: apparmor-profiles Version: 4.1.0~beta5-5 This bug report was invalid as when the rm_conffile prior version is correctly set the conffile is renamed with a dpkg-remove suffix in the prepare phase of the install, ie apparmor-profiles preinstall. That is before apparmor is installed and reload the profiles. Thus indeed the borken /etc/apparmor.d/usr.bin.chromium-browser profile is not there when the apparmor service is reloaded thus this service restart successfully. So there is no need to add an apparmor.service reload in apparmor- profile postinst. This bug report is invalid. Sorry for the noise. Note: I did not find a way to mark a debian bug report as invalid so I marked this one as fixed in the version it was reported found on. CHeers, Alban
--- End Message ---
