[debian-mysql] Bug#865534: Bug#865534: confirmed / steps / clarification

[Otto Kekäläinen]

This is due to the system having a previos AppArmor profile, that is
still enforced.

I don't know if it can be fixed. Maybe the preinstall script should
deactivate the profile?

AppArmor causes a lot of weird errors when it stops the mysqld from
working as expected, and the code inside mysqld does not know how to
fall back from a suddend denial of access. Therefore the profile we
ship has been empty for a few years already to make sure AppArmor
would not confine anything
(https://salsa.debian.org/mariadb-team/mariadb-10.1/blob/master/debian/apparmor-profile).

We need an AppArmor expert in the packaging team to write a good
profile and actively maintain it. Any attempt to do a 99% good profile
that fails 1% of the time would sum up to cause too much trouble.