Hello

After today's Akonadi's update, it doesn't start anymore. Here is the answer from akonadictl :

Code: Select all

$ akonadictl start
org.kde.pim.akonadiserver: Starting up the Akonadi Server...
org.kde.pim.akonadiserver: database server stopped unexpectedly
org.kde.pim.akonadiserver: Database process exited unexpectedly during initial connection!
org.kde.pim.akonadiserver: executable: "/usr/sbin/mysqld-akonadi"
org.kde.pim.akonadiserver: arguments: ("--defaults-file=/home/xabi/.local/share/akonadi/mysql.conf", "--datadir=/home/xabi/.local/share/akonadi/db_data/", "--socket=/run/user/1000/akonadi/default/mysql.socket", "--pid-file=/run/user/1000/akonadi/default/mysql.pid")
org.kde.pim.akonadiserver: stdout: ""
org.kde.pim.akonadiserver: stderr: ""
org.kde.pim.akonadiserver: exit code: 1
org.kde.pim.akonadiserver: process error: "Unknown error"
org.kde.pim.akonadiserver: Failed to remove runtime connection config file
org.kde.pim.akonadiserver: Shutting down AkonadiServer...
org.kde.pim.akonadicontrol: Application '/usr/bin/akonadiserver' exited normally

It seems like MySql can't start, so I looked to ~/.local/share/akonadi/db_data/mysql.err and saw this three errors in the log :

Code: Select all

2019-07-11T13:58:29.838905Z 0 [ERROR] Could not create unix socket lock file /run/user/1000/akonadi/default/mysql.socket.lock.
2019-07-11T13:58:29.838917Z 0 [ERROR] Unable to setup unix socket lock file.
2019-07-11T13:58:29.838926Z 0 [ERROR] Aborting

The /run/user/1000/akonadi/default/ directory has 775 permissions and belongs to my regular user.

Does anybody knows why MySql can't create the lock file ? And how to resolve this, so I can start Akonadi ?

Thank you.

I assume that apparmor prevents access to the directory. Check configuration of apparmor for mysql.

Hello raphaelra, it seems OK to me :

Code: Select all

# apparmor_status
 
apparmor module is loaded.
26 profiles are loaded.
24 profiles are in enforce mode.
   /sbin/dhclient
   /snap/core/7270/usr/lib/snapd/snap-confine
   /snap/core/7270/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   (...)
   /usr/sbin/mysqld-akonadi
   /usr/sbin/mysqld-akonadi///usr/sbin/mysqld
   (...)
2 profiles are in complain mode.
   libreoffice-oopslash
   libreoffice-soffice
3 processes have profiles defined.
3 processes are in enforce mode.
   /sbin/dhclient (1022)
   /usr/sbin/cups-browsed (824)
   /usr/sbin/cupsd (768)
0 processes are in complain mode.
0 processes are unconfined but have a profile defined

And the content of the profil /etc/apparmor.d/usr.sbin.mysqld-akonadi :

Code: Select all

# vim:syntax=apparmor

#include <tunables/global>

/usr/sbin/mysqld-akonadi {
  #include <abstractions/base>

  /usr/sbin/mysqld-akonadi r,
  /usr/sbin/mysqld cx,

  profile /usr/sbin/mysqld {
    #include <abstractions/base>
    #include <abstractions/nameservice>
    #include <abstractions/user-tmp>

    capability setgid,
    capability setuid,

    /etc/mysql/conf.d/ r,
    /etc/mysql/conf.d/* r,
    /etc/mysql/my.cnf r,

    /sys/devices/system/cpu/ r,

    /usr/sbin/mysqld mr,
    /usr/share/mysql/** r,

    @{HOME}/.local/share/akonadi/** rwk,
    owner /home/*/ r,

    # Site-specific additions and overrides. See local/README for details.
    #include <local/usr.sbin.mysqld-akonadi>
  }
}

And did you found there someting abount /run/user/... ?

Try to add someting like:

Code: Select all

/{,var/}run/user/[0-9]*/akonadi/** rwk

to /etc/apprmor.d/local/usr.sbin.mysqld-akonadi

I added this line to the Apparmor profile :

Code: Select all

/run/user/1000/akonadi/default/** rwk,

And it worked ! Akonadi is running now... thank you raphaelra

In ~/.local/share/akonadi (which was already in the apparmor profile) there's a link to the /run/user/1000/akonadi/default directory, but it seems not enough to give the permission to create the socket.

Great to hear that it works

xleon wrote:I added this line to the Apparmor profile :

Code: Select all

/run/user/1000/akonadi/default/** rwk,

I would recommend to use a wildcards (or regexp) in the path for user id (here "1000"). Otherwise nobody else could start mysql for akonadi.

xleon wrote:In ~/.local/share/akonadi (which was already in the apparmor profile) there's a link to the /run/user/1000/akonadi/default directory, but it seems not enough to give the permission to create the socket.

The mysqld argument for --socket probably determines where to create the lockfile and it is /run/user/... and not the linked folder in ~/.local/share/akonadi/.... I don't know where to change the arguments for launching mysqld for akonadi.

raphaelra wrote:I would recommend to use a wildcards (or regexp) in the path for user id (here "1000"). Otherwise nobody else could start mysql for akonadi.

You're right. In my case it works because I'm the only user on the computer.

The mysqld argument for --socket probably determines where to create the lockfile and it is /run/user/... and not the linked folder in ~/.local/share/akonadi/....

True, but I thought Apparmor gave permissions recursively to the linked sub-folder ; I was wrong...

I don't know where to change the arguments for launching mysqld for akonadi.

I don't know either...

Thanks guys! I had the same problem after updating KDE apps to 19.04.3 (starting to second-guess using Neon as my primary OS) by adding raphaelra's line

Code: Select all

 /{,var/}run/user/[0-9]*/akonadi/** rwk

in "/etc/apparmor.d/usr.sbin.mysqld-akonadi", followed by a restart.

In fact it was a bug. There's a new update to akonadi-backend-mysql in the KDE Neon repository, with a corrected apparmor profile containing this new line:

Code: Select all

owner /run/user/*/akonadi/default/* wr,

If you have changed the usr.sbin.mysql-akonadi file, APT will ask you what to do whith that file when you upgrade it. Answer Y to replace it with the package version.

The fix should be in the archive now, please update. I'll discuss with the kdepim team about making changes during a bugfix release which will affect security profiles. Sorry for the breakage.

Works now! Very Thanks for fast Update