Bug#1120454: apparmor.service takes time to finish with the 6.17.6+deb14-amd64 kernel

Vincent Lefevre <[email protected]> Mon, 10 Nov 2025 04:29:26 +0100
Newsgroups gmane.linux.debian.ports.amd64
Message-ID <20251110032926.GA246917__48688.2874088892$1762745492$gmane$org@cventin.lip.ens-lyon.fr>
Package: apparmor
Version: 4.1.0-1
Severity: normal
X-Debbugs-Cc: [email protected]
User: [email protected]
Usertags: amd64

With the 6.17.6+deb14-amd64 kernel, apparmor.service takes time
to finish: when I booted, I got a message of the form

[    *] Job apparmor.service/start running (16s / no limit)

$ journalctl --no-pager -b -u apparmor.service
Nov 07 17:40:26 cventin systemd[1]: Starting apparmor.service - Load AppArmor profiles...
Nov 07 17:40:26 cventin apparmor.systemd[624]: Restarting AppArmor
Nov 07 17:40:26 cventin apparmor.systemd[624]: Reloading AppArmor profiles
Nov 07 17:40:46 cventin systemd[1]: Finished apparmor.service - Load AppArmor profiles.

So it took 20 seconds.

As a comparison, with the 6.16.12+deb14+1-amd64 kernel, I had

$ journalctl --no-pager -b -1 -u apparmor.service
Oct 30 14:48:36 cventin systemd[1]: Starting apparmor.service - Load AppArmor profiles...
Oct 30 14:48:36 cventin apparmor.systemd[706]: Restarting AppArmor
Oct 30 14:48:36 cventin apparmor.systemd[706]: Reloading AppArmor profiles
Oct 30 14:48:36 cventin systemd[1]: Finished apparmor.service - Load AppArmor profiles.

(and this was similar with the previous kernels).

-- System Information:
Debian Release: forky/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable-debug'), (500, 'proposed-updates-debug'), (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.17.6+deb14-amd64 (SMP w/12 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apparmor depends on:
ii  debconf [debconf-2.0]  1.5.91
ii  libc6                  2.41-12

apparmor recommends no packages.

Versions of packages apparmor suggests:
pn  apparmor-profiles-extra  <none>
pn  apparmor-utils           <none>

-- debconf information:
  apparmor/homedirs: