aa_status don't work with confined init (before default profile reload).

Looks like /sys/kernel/security/apparmor/profiles has unexpected content.

Please run (in the state when aa-status errors out)
    cat /sys/kernel/security/apparmor/profiles > /tmp/aa_broken_profiles
and attach that file.

I did
# cat /sys/kernel/security/apparmor/profiles > /tmp/aa_broken_profiles

File attached.

But this is only one line file "default (-)", since no profiles are loaded (I don't load profiles for test purposes). I mean, I can load profiles or not, but issue will remain till confined init are used without default profile reloaded by custom one. As soon, as I reload default profile - all is fine with aa_status usage.

That already explains it - the regex doesn't match the "(-)", but the code expects that the regex always matches ;-)

Can you edit aa-status a bit? Search for (should be line 148)
        match = re.search("^([^\(]+)\s+\((\w+)\)$", p)
and replace it with
        match = re.search("^([^\(]+)\s+\((\w+|-)\)$", p)
(the added part is the "|-" near the end of the regex)

This should prevent the crash.

The interesting question is how aa-status will behave because it only expects "enforce" and "complain", but not "-". From a quick look at the code, I don't expect serious problems - but it might look like it can't count (I wouldn't be surprised if it will say "1 profile loaded" and then print an empty list of profiles).

I did changes into aa-status (in line 148, as you mentioned above). This fixed the issue for me.

# aa-status
apparmor module is loaded.
1 profiles are loaded.
0 profiles are in enforce mode.
0 profiles are in complain mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

I also tested it with loaded profiles (without default profile reload), and all looks good.

Is it possible to add some output like "N processes are confined by default profile." (with list of processes) or something like this in case of internal default profile detected? Or just warning, that default, non reloaded profile are used?