Resolved apparmor Nightmare on Ubuntu 16.04 (STRATO Kaby Lake offer)

[Olray]

I'm not here to waste my time arguing. Pleser refer to my blog. Thanks for understanding.

 

[mr-wolf]

AFAIK you ran into a problem of apparmor with the original kernel.
A kernel upgrade would have solved it.

 

[Olray]

At that state described above it's no longer possible to update the kernel - it will crash your machine.
Also, the kernel updates are hold back by default on the STRATO server installation. I still consider my little article helpful.

 

[mr-wolf]

I had one machine from Strato in a state like you described. Each time it tried to upgrade apparmor it would become unresponsive. After a restart I could see "CPU stuck" messages in the kern.log.
I found info on the web it was due to a problem with the kernel.

I did another forced reset using the Strato panel and after it came back I installed a new kernel and did another restart (graceful this time). After that I was able to do the upgrade of apparmor without the machine getting in an unresponsive state.

I then upgraded the kennel on the other machines from Strato. On these machines I never had the problem.
With hindsight I believe that way was better than what you are recommending.

 

[Olray]

I'm glad to hear that you have successfully solved the problem your way. However,

Your response has several flaws:

• When the error occurs you cannot update your system by use of apt-get which will trigger the configuration of apparmor and grind your system to halt
  
• A crash during a disk write can fubar your file system, i.e. the kernel you just updated. The hdd's filesystem cannot be repaired because the kernel cannot be loaded. A total crash is imminent.
• Updating kernel on production servers is a high risk and needs a total backup of all your data prior to the update. There is a very valid reason for the default installation of Ubuntu Server to hold back these kernel updates.
• While further investigating your claims I just found a post of Plesk itself proclaiming that apparmor is not supported by Plesk and they recommend it's removal. The post is in German language but since you're a customer of STRATO you will certainly be able to read this. Wie Sie AppArmor deaktivieren

My servers are production servers and I need stability and security.
I will not explain my claims in that matter any further. We both have solved our problem somehow and should refrain from tearing apart our arguments. I consider your argumentation valid but only prior to the occuring of that issue.

 

[UFHH01]

Hi Olray,

While further investigating your claims I just found a post of Plesk itself proclaiming that apparmor is not supported by Plesk and they recommend it's removal. The post is in German language but since you're a customer of STRATO you will certainly be able to read this. Wie Sie AppArmor deaktivieren

This is only partly correct, Olray. Pls. have a closer look at the "english" version of this KB - article:

=> How to disable AppArmor?​

As you can see, it states clear:

AppArmor is not supported by Plesk 12.x. Sometimes AppArmor can interfere with Plesk installation or functionality.

and within the "german" version:

AppArmor wird nicht von Parallels Plesk Panel (Plesk) unterstützt. Unter Umständen kann AppArmor die Installation von Parallels Plesk Panel unterbrechen oder die Funktionalität beeinträchtigen.

These differences are in fact a bit irritating, but we will try to improve that with a more precise translation in that case.

 

[mr-wolf]

I'm glad to hear that you have successfully solved the problem your way. However,

Your response has several flaws:

• When the error occurs you cannot update your system by use of apt-get which will trigger the configuration of apparmor and grind your system to halt

No... I was able to use apt to update the kernel without initiating the upgrade of apparmor.
Don't ask me how... was a stressing session.
After that the upgrade of apparmor gave no problem.

• While further investigating your claims I just found a post of Plesk itself proclaiming that apparmor is not supported by Plesk and they recommend it's removal. The post is in German language but since you're a customer of STRATO you will certainly be able to read this. Wie Sie AppArmor deaktivieren

Plesk Onyx has support for apparmor and we are adviced not to deactivate it.
I'm using Plesk Onyx. You never stated your version.