AppArmor TOK_SET_VAR inesperado, esperando TOK_END_OF_RULE

Question

Em um Ubuntu recém-instalado, com apenas alguns pacotes adicionados, depois de tentar reiniciar o apparmor, ele não inicia mais, dando o mesmo erro para todos os perfis

-- Unit apparmor.service has begun starting up.
Jan 14 17:36:24 panel apparmor[1922]:  * Starting AppArmor profiles
Jan 14 17:36:24 panel apparmor[1922]: AppArmor parser error for /etc/apparmor.d/sbin.dhclient in /etc/apparmor.d/tunables/kernelvars at line 16: syntax error, unexpected TOK_SET_VAR, expecting TOK_END_OF_RULE
Jan 14 17:36:24 panel apparmor[1922]: AppArmor parser error for /etc/apparmor.d/lxc-containers in /etc/apparmor.d/tunables/kernelvars at line 16: syntax error, unexpected TOK_SET_VAR, expecting TOK_END_OF_RULE
Jan 14 17:36:24 panel apparmor[1922]: AppArmor parser error for /etc/apparmor.d/usr.bin.lxc-start in /etc/apparmor.d/tunables/kernelvars at line 16: syntax error, unexpected TOK_SET_VAR, expecting TOK_END_OF_RULE
Jan 14 17:36:24 panel apparmor[1922]: AppArmor parser error for /etc/apparmor.d/usr.lib.lxd.lxd-bridge-proxy in /etc/apparmor.d/tunables/kernelvars at line 16: syntax error, unexpected TOK_SET_VAR, expecting TOK_END_OF_RULE
Jan 14 17:36:24 panel apparmor[1922]: AppArmor parser error for /etc/apparmor.d/usr.lib.snapd.snap-confine.real in /etc/apparmor.d/tunables/kernelvars at line 16: syntax error, unexpected TOK_SET_VAR, expecting TOK_END_OF_RULE
Jan 14 17:36:24 panel apparmor[1922]: AppArmor parser error for /etc/apparmor.d/usr.sbin.mysqld in /etc/apparmor.d/tunables/kernelvars at line 16: syntax error, unexpected TOK_SET_VAR, expecting TOK_END_OF_RULE
Jan 14 17:36:24 panel apparmor[1922]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
Jan 14 17:36:24 panel apparmor[1922]: AppArmor parser error for /etc/apparmor.d/usr.sbin.tcpdump in /etc/apparmor.d/tunables/kernelvars at line 16: syntax error, unexpected TOK_SET_VAR, expecting TOK_END_OF_RULE
Jan 14 17:36:24 panel apparmor[1922]: AppArmor parser error for /etc/apparmor.d/lxc-containers in /etc/apparmor.d/tunables/kernelvars at line 16: syntax error, unexpected TOK_SET_VAR, expecting TOK_END_OF_RULE
Jan 14 17:36:24 panel apparmor[1922]: AppArmor parser error for /etc/apparmor.d/sbin.dhclient in /etc/apparmor.d/tunables/kernelvars at line 16: syntax error, unexpected TOK_SET_VAR, expecting TOK_END_OF_RULE
Jan 14 17:36:24 panel apparmor[1922]: AppArmor parser error for /etc/apparmor.d/usr.bin.lxc-start in /etc/apparmor.d/tunables/kernelvars at line 16: syntax error, unexpected TOK_SET_VAR, expecting TOK_END_OF_RULE
Jan 14 17:36:24 panel apparmor[1922]: AppArmor parser error for /etc/apparmor.d/usr.lib.lxd.lxd-bridge-proxy in /etc/apparmor.d/tunables/kernelvars at line 16: syntax error, unexpected TOK_SET_VAR, expecting TOK_END_OF_RULE
Jan 14 17:36:24 panel apparmor[1922]: AppArmor parser error for /etc/apparmor.d/usr.lib.snapd.snap-confine.real in /etc/apparmor.d/tunables/kernelvars at line 16: syntax error, unexpected TOK_SET_VAR, expecting TOK_END_OF_RULE
Jan 14 17:36:24 panel apparmor[1922]: AppArmor parser error for /etc/apparmor.d/usr.sbin.mysqld in /etc/apparmor.d/tunables/kernelvars at line 16: syntax error, unexpected TOK_SET_VAR, expecting TOK_END_OF_RULE
Jan 14 17:36:24 panel apparmor[1922]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
Jan 14 17:36:24 panel apparmor[1922]: AppArmor parser error for /etc/apparmor.d/usr.sbin.tcpdump in /etc/apparmor.d/tunables/kernelvars at line 16: syntax error, unexpected TOK_SET_VAR, expecting TOK_END_OF_RULE
Jan 14 17:36:24 panel apparmor[1922]:    ...fail!
Jan 14 17:36:24 panel systemd[1]: apparmor.service: Control process exited, code=exited status=123
Jan 14 17:36:24 panel systemd[1]: Failed to start LSB: AppArmor initialization.

Se eu comentar uma linha em kernelvars, isso dará um erro na próxima linha para @ {tid}. Comentando todas as linhas, dá um erro em outro arquivo que está definindo um var. Como posso consertar isso?

    

Answer 1

Usando apparmor_parser -qp /etc/apparmor.d/sbin.dhclient , vi que o erro era do perfil carregado anterior /etc/apparmor.d/tunables/alias , que não tinha uma vírgula no final (não prestou atenção depois de adicionar o alias do lib mysql).