[SOLVED] Apparmor service not starting after Trixie upgrade

** Issue Link **

#security

Problem Description
Apparmor service is stopped after Trixie upgrade. Service cannot be started from Cockpit. I have a couple reboots since completing the upgrade.

Apparmor description:
AppArmor is a kernel enhancement to confine programs to a limited set
of resources. AppArmor’s unique security model is to bind access
control attributes to programs rather than to users.

Steps to Reproduce

  1. Upgrade FreedomBox to Trixie
  2. Open cockpit and select the Administrative Access option
  3. Look in Cockpit for stopped services
  4. Apparmor is stopped
  5. Start the service manually and this fails.

Expected Results
Apparmor service is running.

Actual results
Log messages:
August 24, 2025

6:15 PM

Failed to start apparmor.service - Load AppArmor profiles.

systemd

6:15 PM

apparmor.service: Failed with result ‘exit-code’.

systemd

6:15 PM

apparmor.service: Main process exited, code=exited, status=1/FAILURE

systemd

6:15 PM

Error: At least one profile failed to load

apparmor.systemd

6:15 PM

ERROR processing regexs for profile su, failed to load

apparmor.systemd

6:15 PM

profile has merged rule with conflicting x modifiers

apparmor.systemd

6:14 PM

Reloading AppArmor profiles

apparmor.systemd

6:14 PM

Restarting AppArmor

apparmor.systemd

6:14 PM

Starting apparmor.service - Load AppArmor profiles…

systemd

Screenshot
Failed service

Service relationships

Information

  • FreedomBox version: You are running Debian GNU/Linux 13 (trixie) and FreedomBox version 25.9.3. FreedomBox is up to date.
  • Hardware: Intel Atom 6.12.41+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.41-1 (2025-08-12) x86_64 GNU/Linux
  • How did you install FreedomBox?: Installed over Jessie and upgraded.

There was an ejabberd apparmor profile which was preventing this service from starting. ejabberd was inactive on my FreedomBox and unused for a long time. GUI removal of ejabberd removed the apparmor profile which was causing the service to fail.

You can diagnose a problem such as this by using the logs applet in Cockpit.

Starting with this log entry…

I knew I needed something related to ‘su’. This command helped me find the suspect apparmor profile (does not need root):
/sbin/apparmor_parser -N /etc/apparmor.d | grep su

The output from this included /usr/sbin/ejabberdctl//su which lead me to uninstalling ejabberd.

1 Like

If you look for a different problem try this command instead:
/sbin/apparmor_parser -N /etc/apparmor.d

The command above only gives results containing the string “su” because of the | grep su part at the end.