apparmor_parser: Unable to replace "/usr/lib/cups/backend/cups-pdf". Profile doesn't conform to protocol

The terminal log reads:

----------
Trigger für cups werden verarbeitet ...
start: Job failed to start
invoke-rc.d: initscript cups, action "start" failed.
dpkg: Fehler beim Bearbeiten von cups (--unpack):
 Unterprozess installiertes post-installation-Skript gab den Fehlerwert 1 zurück
----------

Looks like a problem with Upstart, pitti, can you have a look into this?

Is your system completely up-to-date?

Please do

  wget http://people.canonical.com/~pitti/tmp/cups.upstart.debug
  sudo cp /etc/init/cups.conf{,.orig}
  sudo cp cups.upstart.debug /etc/init/cups.conf
  sudo stop cups
  sudo start cups

This should fail again. Please attach /tmp/log here.

After that, please restore the original script again with

  sudo mv /etc/init/cups.conf{.orig,}

Thanks!

Here is the log

+ /lib/init/apparmor-profile-load usr.sbin.cupsd
/sbin/apparmor_parser: Unable to replace "/usr/lib/cups/backend/cups-pdf". Profile doesn't conform to protocol
Warning failed to create cache: usr.sbin.cupsd

Status changed to 'Confirmed' because the bug affects multiple users.

I notice you are not using the precise kernel but instead
  Linux 3.3.0-09248-g1338631 x86_64

Can you attach the following information
  .config file for the kernel in use
  Any additional information about this 3.3 kernel that might be relevant, patches applied, etc.

  The output of
    apparmor_parser -V
    ls -R /sys/kernel/security/apparmor/

The debug.file generate by
    apparmor_parser -QT -o debug.file usr.sbin.cupsd

Hello,

I use this kernel: 3.4.0-999-generic #201204010405 not 3.3.0

2012-04-02 22:25 keltezéssel, John Johansen írta:
> I notice you are not using the precise kernel but instead
> Linux 3.3.0-09248-g1338631 x86_64
>
> Can you attach the following information
> .config file for the kernel in use
> Any additional information about this 3.3 kernel that might be relevant, patches applied, etc.
>
> The output of
> apparmor_parser -V
> ls -R /sys/kernel/security/apparmor/
>
> The debug.file generate by
> apparmor_parser -QT -o debug.file usr.sbin.cupsd
>

I use clean master branch from kernel.org

i also did some testing and this problem was introduced by some patch between v3.3 and v3.3.0-09248-g1338631. v3.4.0-rc1-00104-g7d6e1cb is still effected. Today i will probably have no time for bisecting.

=====================================
apparmor_parser -V
AppArmor parser version 2.7.102
Copyright (C) 1999-2008 Novell Inc.
Copyright 2009-2012 Canonical Ltd.

=====================================
ls -R /sys/kernel/security/apparmor/
/sys/kernel/security/apparmor/:
features

/sys/kernel/security/apparmor/features:
capability domain file rlimit

/sys/kernel/security/apparmor/features/domain:
change_hat change_hatv change_onexec change_profile

/sys/kernel/security/apparmor/features/file:
mask

/sys/kernel/security/apparmor/features/rlimit:
mask

Thanks Oleksij

I know what the problem is, and we should have a test apparmor_parser available for you to try in a couple hours

Have resolved the same issue on Precise by installing appmenu-indicator

This bug was fixed in the package apparmor - 2.7.102-0ubuntu3

---------------
apparmor (2.7.102-0ubuntu3) precise; urgency=low

  [ Jamie Strandboge ]
  * debian/patches/0007-ubuntu-manpage-updates.patch: update apparmor(5)
    to describe Ubuntu's two-stage policy load and how to add utilize it
    when developing policy (LP: #974089)

  [ Serge Hallyn ]
  * debian/apparmor.init: do nothing in a container. This can be
    removed once stacked profiles are supported and used by lxc.
    (LP: #978297)

  [ Steve Beattie ]
  * debian/patches/0008-apparmor-lp963756.patch: Fix permission mapping
    for change_profile onexec (LP: #963756)
  * debian/patches/0009-apparmor-lp959560-part1.patch,
    debian/patches/0010-apparmor-lp959560-part2.patch: Update the parser
    to support the 'in' keyword for value lists, and make mount
    operations aware of 'in' keyword so they can affect the flags build
    list (LP: #959560)
  * debian/patches/0011-apparmor-lp872446.patch: fix logprof missing
    exec events in complain mode (LP: #872446)
  * debian/patches/0012-apparmor-lp978584.patch: allow inet6 access in
    dovecot imap-login profile (LP: #978584)
  * debian/patches/0013-apparmor-lp800826.patch: fix libapparmor
    log parsing library from dropping apparmor network events that
    contain ip addresses or ports in them (LP: #800826)
  * debian/patches/0014-apparmor-lp979095.patch: document new mount rule
    syntax and usage in apparmor.d(5) manpage (LP: #979095)
  * debian/patches/0015-apparmor-lp963756.patch: Fix change_onexec
    for profiles without attachment specification (LP: #963756,
    LP: #978038)
  * debian/patches/0016-apparmor-lp968956.patch: Fix protocol error when
    loading policy to kernels without compat patches (LP: #968956)
  * debian/patches/0017-apparmor-lp979135.patch: Fix change_profile to
    grant access to /proc/attr api (LP: #979135)
 -- Steve Beattie <email address hidden> Thu, 12 Apr 2012 06:17:42 -0500