Comment 5 for bug 399954

Thanks Tim.

The bug is in the dhcp3-client script, specifically this bit:

# Wait for apparmor to load
while [ ! -e "$AAPROFILES" ]; do
    # If apparmor is not loaded by the time we leave rcS, we go into S from
    # another runlevel, or are in a non-S runlevel, just exit
    runlevel | grep -E -q '( [0-9]|[0-9] S)' && exit 0
    sleep 1
done

For various reasons, this is _NEVER_ going to work!

Firstly we call "ifup" from udev for most standard network devices, and this happens very early in the boot sequence. At this point the /var/run/utmp file doesn't exist, so runlevel will output that error and exit because it can't find the file.

Secondly "runlevel" inherently returns undefined data when running through rcS.d, because you have not yet entered a runlevel. rcS.d is not the "single-user runlevel", it is the sysinit phase; until this is completed, you are neither in single-user mode *or* multi-user mode. You're still bootstrapping the system.

In fact, during rcS.d runlevel will always exit with an error code; if you happen to catch it before /var/run/utmp is created you'll get that error - if you catch it after there won't be a runlevel record in there yet, so you'll get "unknown"

I'm not entirely sure why you're grepping for "we go into S from another runlevel", going into the S runlevel (single-user mode) does not invoke anything in rcS.d -- rc1.d is used to do that. I could not find any mention of apparmor in /etc/rc1.d

This also doesn't cope with another possibility, that you *boot* into single-user mode. In this case runlevel will output (after finishing rcS.d and running sulogin)

   N S

ie. you entered single-user mode (the S runlevel) directly, without a previous runlevel.

Now what happens if you enter rc2 ? Your runlevel output will be:

  S 2

ie. you entered runlevel 2 from single-user mode.

(Booting directly into multi-user mode, you would get

  N 2

because you booted directly into it - you don't go "via" single-user to get there)

It also occurs to me that this script is incredibly brittle anyway, because it doesn't account for the fact that apparmor may fail to load any profiles.

If that happens, you may end up looping forever in S40networking waiting for apparmor profiles to appear. I think this is what happened to Tim.