Knowledge Base

Unable to start MySQL on Ubuntu with Plesk: AVC apparmor=”DENIED” operation=”open”

Symptoms

MySQL on Ubuntu fails to start. The following error messages appear in the output of the journalctl -xe command:

AVC apparmor="DENIED" operation="open" profile="/usr/sbin/mysqld" name="/proc/666999/status" pid=666999 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=124 ouid=124
AVC apparmor="DENIED" operation="open" profile="/usr/sbin/mysqld" name="/sys/devices/system/node/" pid=666999 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=124 ouid=0
audit: type=1400 audit(): apparmor="DENIED" operation="open" profile="/usr/sbin/mysqld" name="/proc/666999/status" pid=666999 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=124 ouid=124
audit: type=1400 audit(): apparmor="DENIED" operation="open" profile="/usr/sbin/mysqld" name="/sys/devices/system/node/" pid=666999 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=124 ouid=0

Cause

AppArmor is not properly configured.

Resolution

Solution I: Add permissions to the required objects

Add permissions to the objects reported in the lines that start with ‘name=‘ in the output to the file /etc/apparmor.d/usr.sbin.mysqld.

In this example, it is required to add r permissions to /proc/*/status and /sys/devices/system/node/. The paths may be different depending on the error messages.

Connect the server via SSH.
Open the file /etc/apparmor.d/usr.sbin.mysqld in a text editor (for example, vi editor) and add the lines below at the end of the /usr/sbin/mysqld section at the end of the file:
```
/usr/sbin/mysqld {
...
/proc/*/status r,
/sys/devices/system/node/ r,
/sys/devices/system/node/node*/meminfo r,
/sys/devices/system/node/*/* r,
/sys/devices/system/node/* r,
...
}
```
Reload AppArmor configuration for MySQL service:

# apparmor_parser -r /etc/apparmor.d/usr.sbin.mysqld
Start MySQL server:

# service mysql start

Note: In case MySQL fails to start again, check the output of journalctl -xe for new error messages.

Solution II: Disable AppArmor for MySQL

MySQL might require lots of libraries and files to be accessed and it may take a lot of time to configure all of them.

Connect the Plesk server via SSH.
Disable AppArmor for MySQL:

# ln -s /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/disable/
# apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld