Hi,

With AppArmor 5.0 userspace (currently in Debian experimental), the
cups service remains stuck in "starting" state and for example
"systemctl restart cups" never returns.

Here's the fix:
https://salsa.debian.org/printing-team/cups/-/merge_requests/17

I intend to upload AppArmor 5.0.x to sid in August or September,
so it would be good if the fix for cups.service was in sid by then :)

Thanks!

Thanks for the fix, but why is there another special treatment needed
for another directory of systemd? Can't apparmor use /run/systemd/notify
instead?

   Thorsten

Hi,

Thorsten Alteholz (2026-07-14):

Frankly I don't know the technical reason: I lack expertise about why
these paths are "disconnected" and where they end up being visible at
by the relevant bits of the kernel. I'm putting pkg-apparmor-team in
copy, some upstream folks are there, perhaps someone can elaborate.
Otherwise I can go ask upstream folks directly.

What I can tell is that this class of problems is well known with this
parser upgrade and the fix is always this one, e.g. for policy shipped
upstream:

 - https://gitlab.com/apparmor/apparmor/-/merge_requests/2122
 - https://gitlab.com/apparmor/apparmor/-/merge_requests/2116

Cheers,