How to fix apparmor="DENIED" for telepathy-mission-control-5 under Ubuntu 14.04?

Question

Just installed Ubuntu 14.04 LTS a week ago and a few programs for my work & fun:

• nginx server, rabbitmq server, mysql server
• php-fpm, hhvm
• sublime-text, mysql workbench
• hplib (for printer/scanner)
• composer, bower, nodejs, npm
• vlc player
• steam (no games installed yet)

Nothing really fancy. I've also installed plasma-desktop (to try out it's widgets), but after a few hours I uninstalled it with --purge and then apt-get autoremove.

Today, upon logging in I saw an error message 3 times. First occured after entering my password on login screen, but before my desktop loaded (it appeared "on top of login screen"). Second message, appeared just after the login screen disappeared, and desktop started loading. The third message appeared when desktop finished loading.

No idea when the 4th happened.

Since that time it's been about 20 minutes and no further error messages.

So, I've looked up /etc/syslog and here we go:

Jul  2 09:26:48 Earth kernel: [ 1090.959820] type=1400 audit(1404286008.832:76): apparmor="DENIED" operation="open" profile="/usr/lib/telepathy/mission-control-5" name=2F6D656469612F53746F726167652F50726F66696C652F5562756E74752031342E30342F6C6F6F7374726F2F2E636F6E6669672F6C69626163636F756E74732D676C69622F6163636F756E74732E6462 pid=3310 comm="mission-control" requested_mask="rw" denied_mask="rw" fsuid=1000 ouid=1000
Jul  2 09:26:48 Earth kernel: [ 1090.960061] type=1400 audit(1404286008.832:77): apparmor="DENIED" operation="open" profile="/usr/lib/telepathy/mission-control-5" name=2F6D656469612F53746F726167652F50726F66696C652F5562756E74752031342E30342F6C6F6F7374726F2F2E636F6E6669672F6C69626163636F756E74732D676C69622F6163636F756E74732E6462 pid=3310 comm="mission-control" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
Jul  2 09:26:48 Earth kernel: [ 1090.967927] type=1400 audit(1404286008.840:78): apparmor="DENIED" operation="open" profile="/usr/lib/telepathy/mission-control-5" name=2F6D656469612F53746F726167652F50726F66696C652F5562756E74752031342E30342F6C6F6F7374726F2F2E636F6E6669672F64636F6E662F75736572 pid=3310 comm="mission-control" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
Jul  2 09:26:48 Earth kernel: [ 1091.034552] type=1400 audit(1404286008.908:79): apparmor="DENIED" operation="open" profile="/usr/lib/telepathy/mission-control-5" name=2F6D656469612F53746F726167652F50726F66696C652F5562756E74752031342E30342F6C6F6F7374726F2F2E6C6F63616C2F73686172652F74656C6570617468792F6D697373696F6E2D636F6E74726F6C2F6163636F756E74732E636667 pid=3310 comm="mission-control" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000

Note the name part looks completely rubbish.

I've googled this error message, and found a few bug reports:

• #1190865
• #1217618
• #1320394

They say it's an error in apparmor, but no clues how to fix it.

Also, I don't remember installing telepathy-mission-control-5. I've looked up reverse dependencies:

loostro@Earth:~$apt-cache rdepends telepathy-mission-control-5
telepathy-mission-control-5
Reverse Depends:
  telepathy-gabble:i386
  gnome-shell
  telepathy-gabble
  mcp-account-manager-uoa
  empathy
  telepathy-mission-control-5:i386
  telepathy-gabble:i386
  telephony-service
  ssh-contact-client
  python-sugar3
  python-sugar-toolkit-0.98
  python-sugar-toolkit-0.96
  kde-telepathy-minimal
  gnome-shell
  telepathy-mission-control-5-dbg
  telepathy-gabble
  mcp-account-manager-uoa
  libmission-control-plugins0
  empathy

Well, it seems alot of stuff depends in it. It does not look like I can simply uninstall it, as it would probably break something.

Is there a way to fix this? How?

Note: the first error message (in English) is the one that appears before logging in (and unless closed - it stays after login). The second error message (in Polish) is exacly the same error, but it appears after logging in and in correct language.

It seems like "before logging in" the system does not know which language I use, so it defaults to english.

Solution

First of all some introductory words as to what mission-control is:

Mission Control implements [...] the Telepathy D-Bus specification, allowing clients like empathy to store account details, connect to accounts, request communication channels, and have channels dispatched to them.

Source

To disable the mission-control profile for apparmor, first use aa-status. This lists all profiles and their mode of operation, the output is somewhat similar to this:

# aa-status
apparmor module is loaded.
6 profiles are loaded.
5 profiles are in enforce mode.
   /bin/ping
   /sbin/klogd
   /sbin/syslog-ng
   /usr/sbin/dnsmasq
   /usr/sbin/identd
1 profiles are in complain mode.
   /usr/sbin/lspci
1 processes have profiles defined.
1 processes are in enforce mode.
   /usr/sbin/dnsmasq (12905)
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

Check the output for the profile of mission-control.

If you link the profile to /etc/apparmor.d/disable, it isn't automatically loaded anymore and the errors should be gone.

Notice that this is more of a workaround stopping the messages, rather than fixing the root cause of the issue.

If you want to dig deeper and fix the aa profile, then read http://wiki.apparmor.net/index.php/QuickProfileLanguage and change the mission-control profile accordingly.

Comments

[loostro]

thanks for anwser! i've got one more question: is it safe to disable the profile for mission-control? i mean.. there has to be a reason it's "guarded" by apparmor..

[Jetson Earth]

Disclaimer: I don't use aa at all. I don't know why Ubuntu, unlike its upstream Debian, installs and enables apparmor by default. I neither know if there'll be ill side effects when disabling the profile. All I can tell you is that the telepathy profile first shipped with 11.10. IMHO there's little risk in just trying, you can always re-enable it later.