AppArmor Parser Errors and Service Failures

AppArmor is enabled by default on Parrot OS to enforce mandatory access controls and isolate processes. However, during system upgrades, virtual machine image deployments, or conffile cleanups, critical tunable definitions in /etc/apparmor.d/tunables/ may become missing or corrupt.

When this occurs, apparmor.service fails during startup, causing container runtimes (such as Docker, Podman, and containerd) and sandboxed applications to fail immediately.

Symptoms and Error Indicators

Common indicators of broken AppArmor configurations include:

Systemd Service Failure

Checking the service status reports that profiles failed to load:

┌─[user@parrot]─[~]
└──╼ $ systemctl status apparmor

Output:

? apparmor.service - Load AppArmor profiles
     Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; preset: enabled)
     Active: failed (Result: exit-code)
    Process: 642 ExecStart=/lib/apparmor/apparmor.systemd reload (code=exited, status=1/FAILURE)
   Main PID: 642 (code=exited, status=1/FAILURE)

Parser Errors in System Journal

Inspecting journalctl -u apparmor reveals missing tunables:

AppArmor parser error for /etc/apparmor.d in profile /etc/apparmor.d/tunables/global at line 17: Could not open 'tunables/proc'
AppArmor parser error for /etc/apparmor.d in profile /etc/apparmor.d/tunables/global at line 24: Could not open 'tunables/run'
Error: At least one profile failed to load

Container Engine Failures

Attempting to run a container fails with daemon or profile loading errors:

┌─[user@parrot]─[~]
└──╼ $ docker run --rm hello-world

Output:

docker: Error response from daemon: AppArmor profile not loaded: apparmor_parser failed with error.

---

Why Standard Reinstallation Fails

Running sudo apt install --reinstall apparmor often does not resolve the issue. By default, Debian’s package manager (dpkg) ignores missing configuration files in /etc upon package reinstallation. This behavior exists to respect intentional administrator deletions, but it prevents default tunable templates from being automatically restored.

---

Step-by-Step Resolution

Step 1: Force Restoration of Missing Conffiles

Instruct dpkg to restore all missing default configuration files and tunables using the --force-confmiss option:

sudo apt-get update
sudo apt-get -o Dpkg::Options::="--force-confmiss" install --reinstall apparmor apparmor-utils

Step 2: Verify Restored Tunables

Confirm that the core tunable definitions are present in /etc/apparmor.d/tunables/:

┌─[user@parrot]─[~]
└──╼ $ ls -l /etc/apparmor.d/tunables/proc /etc/apparmor.d/tunables/run

Expected output confirms both files exist:

-rw-r--r-- 1 root root ... /etc/apparmor.d/tunables/proc
-rw-r--r-- 1 root root ... /etc/apparmor.d/tunables/run

Step 3: Restart and Validate AppArmor

Restart the systemd service to re-parse all profiles:

┌─[user@parrot]─[~]
└──╼ $ sudo systemctl restart apparmor

Verify that the service is active and profiles are successfully loaded:

┌─[user@parrot]─[~]
└──╼ $ sudo aa-status

The output should confirm that profiles are loaded in enforce or complain mode without parser errors.

Step 4: Restart Container Runtimes

Once AppArmor is operational, restart Docker or your respective container manager:

sudo systemctl restart docker
docker run --rm hello-world

The container should initialize and execute successfully.