Apparmor fails to load in the Gateway

Systemcheck returns the following message lately:
WARNING: System ready check (system) Result: Failed.

Debugging information:
Command:
‘sudo systemctl --wait is-system-running’ (same as ‘leaprun system-ready-check’)
result: ‘degraded’
WARNING: systemd ‘system’ units check result: One or more units failed to load.

A possible system issue was detected. There is no need to panic. This is not a serious security problem. However, it may impact other system checks.

Some systemd ‘system’ units may be stuck in a failed, activating, or deactivating state.
Output of ‘leaprun read-systemctl-logs-failed-units-pretty’:
(equivalent to: sudo systemctl --state=failed,activating,deactivating list-units)

########################################
UNIT LOAD ACTIVE SUB DESCRIPTION

  • apparmor.service loaded failed failed Load AppArmor profiles

Legend: LOAD → Reflects whether the unit definition was properly loaded.
ACTIVE → The high-level unit activation state, i.e. generalization of SUB.
SUB → The low-level unit activation state, values depend on unit type.

1 loaded units listed.
########################################

To check manually:

  1. Open a terminal. (Start Menu → System → Terminal)
  2. Run:
    leaprun read-systemctl-logs-failed-units-pretty
    If you know what you are doing, feel free to disable this check. Create a file /etc/systemcheck.d/50_user.conf and add:
    systemcheck_skip_functions+=" check_services_do "

No such message in the Workstation. Any tips?

We’ll need to see why the AppArmor service is failing to know how to help. Please boot into PERSISTENT Mode | SYSMAINT Session, then click “Open Terminal” and run:

sudo journalctl -u apparmor.service

Press Shift+G to move to the bottom of the logs, then share the output here. (You can upload a screenshot of the logs to a file hosting service of your choice and share it here if that’s easiest.)

1 Like

-- Boot 0107a247d678429d98b576f5e9ad74d4 –

Sep 23 21:13:35 host systemd[1]: Starting apparmor.service - Load AppArmor profiles…

Sep 23 21:13:35 host apparmor.systemd[706]: Restarting AppArmor

Sep 23 21:13:35 host apparmor.systemd[706]: Reloading AppArmor profiles

Sep 23 21:13:35 host apparmor.systemd[1117]: profile system_tor: has merged rule /rw/usr/bin/lyrebird with conflicting x modifiers

Sep 23 21:13:35 host apparmor.systemd[1117]: ERROR merging rules for profile system_tor, failed to load

Sep 23 21:13:35 host apparmor.systemd[706]: Error: At least one profile failed to load

Sep 23 21:13:35 host systemd[1]: apparmor.service: Main process exited, code=exited, status=1/FAILURE

Sep 23 21:13:35 host systemd[1]: apparmor.service: Failed with result ‘exit-code’.

Sep 23 21:13:35 host systemd[1]: Failed to start apparmor.service - Load AppArmor profiles.

Can you share the output of:

cd /etc/apparmor.d; grep -ri lyrebird
1 Like

cd /etc/apparmor.d; grep -ri lyrebird
local/system_tor.anondist:## lyrebird
local/system_tor.anondist: /usr/bin/lyrebird rix,
abstractions/tor: /usr/bin/lyrebird Pix,

Pretty sure that’s the issue, as that line in that file is not present on my system, whereas the one in abstractions/tor is present. Did you install anything Tor- or Lyrebird-related recently?

You can probably fix the issue for now by doing the following:

  • Run sudo nano /etc/apparmor.d/local/system_tor.anondist
  • Move your cursor to the /usr/bin/lyrebird rix, line
  • Comment the line out by typing a single # before the rest of the line, so that it reads #/usr/bin/lyrebird rix,
  • Save the file with Ctrl+S
  • Exit the text editor with Ctrl+X
  • Reboot
1 Like

Thank you, that fixed it. I installed lyrebird several months ago following this guide

which advises adding /usr/bin/lyrebird rix.
But this bug popped out for the first time about a week ago. I hope, commenting this out shouldn’t impair anything crucial?

It should be fine if lyrebird continues to work. rix basically says “Tor can launch lyrebird, but lyrebird will be confined with the same AppArmor profile Tor is.” “Pix” basically says “Tor can launch Lyrebird, and if there is a separate profile for lyrebird, it will be used. Otherwise, it will be confined with the same AppArmor profile Tor is.” So it’s potentially a bit more secure.

2 Likes