@[toc]

Ubuntu 虚拟机根文件系统损坏故障的深度分析与修复

在这里插入图片描述

1. 问题背景与故障现象

本次故障发生于一台运行 Ubuntu 的虚拟机。异常关机后，系统在下次启动过程中无法正常完成根文件系统挂载，进入 initramfs 维护环境并要求手动执行文件系统一致性修复。

1
2
3
4
5
flowchart TB
    A[异常关闭虚拟机电源] --> B(下次启动时进行文件系统检查)
    B --> C{检测到根文件系统错误}
    C --> |是| D[挂载根分区失败，进入initramfs环境]
    D --> E[管理员执行fsck修复]

1.1 initramfs 进入条件与报错定位

系统在启动早期阶段输出以下错误信息，表明根分区 /dev/sda5 需要人工修复：

1
2
3
4
/dev/sda5 contains a file system with errors, check forced.
Directory inode ... directory corrupted
UNEXPECTED INCONSISTENCY; RUN fsck MANUALLY.
The root filesystem on /dev/sda5 requires a manual fsck

上述信息可被分解为以下事实：

  1. /dev/sda5 文件系统存在错误（contains a file system with errors）。
  2. 系统触发强制检查（check forced）。
  3. 目录 inode 结构损坏（directory corrupted）。
  4. 系统拒绝继续挂载根文件系统并进入 initramfs（UNEXPECTED INCONSISTENCY; RUN fsck MANUALLY）。
1
2
3
4
5
flowchart TB
    S[启动阶段挂载根分区] --> J{检测到ext文件系统错误?}
    J --> |否| OK[继续引导进入用户空间]
    J --> |是| R[拒绝挂载根分区并进入initramfs]
    R --> P[提示手动执行fsck]

1.2 故障常见诱因与约束条件

该类故障常见诱因包括：

  • 虚拟机进程被强制结束。
  • 宿主机断电或异常重启。
  • 宿主机休眠/关机时虚拟机未正常关机。
  • 虚拟磁盘 I/O 在写入阶段被中断。

此类诱因通常导致 ext4 日志未完成提交或元数据更新中断，进而触发一致性错误。

1
2
3
4
flowchart TB
    X[非正常关机] --> Y[写入中断/日志未完成]
    Y --> Z[元数据不一致]
    Z --> W[启动时根分区挂载失败]

2. 手动文件系统修复过程（fsck）

在 initramfs 环境下，管理员根据提示手动对根分区执行 fsck。典型命令如下：

1
(initramfs) fsck -f /dev/sda5
1
2
3
4
5
6
7
8
9
flowchart TB
    A[进入initramfs] --> B[确认目标分区/dev/sda5]
    B --> C[执行fsck -f /dev/sda5]
    C --> D{是否提示修复?}
    D --> |是| E[逐项确认Fix/Salvage/Optimize为yes]
    D --> |否| F[进入下一检查阶段]
    E --> F
    F --> G[fsck结束并输出结果]
    G --> H[重启系统]

2.1 ext4 的 fsck 多阶段检查机制

针对 ext4 文件系统，fsck（更具体为 e2fsck）通常按以下阶段执行：

  • Pass 1：检查 inode、块映射与大小一致性。
  • Pass 2：检查目录结构。
  • Pass 3：检查目录连通性。
  • Pass 4：检查引用计数一致性。
  • Pass 5：检查空闲块/空闲 inode 位图一致性。
1
2
3
4
5
flowchart TB
    P1[Pass 1: inode/blocks/sizes] --> P2[Pass 2: directory structure]
    P2 --> P3[Pass 3: directory connectivity]
    P3 --> P4[Pass 4: reference counts]
    P4 --> P5[Pass 5: free space bitmaps]

2.2 fsck 输出内容的结构化解读

在修复过程中出现以下关键提示（为保持材料完整性，原样引用）：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
Inode 19 extent tree (at level 2) could be narrower. Optimize? yes

Directory inode 1715526 (???) directory has no checksum.
directory corrupted
Salvage? yes

Missing '.' in directory inode 1715526.
Fix? yes

Setting filetype for entry '.' in <parent_dir> to 2
(表示将 '.' 条目标记为目录类型)

Missing '..' in directory inode 1715526.
Fix? yes

Missing '..' in directory inode 1715530.
Fix? yes

对上述提示可分步骤解释如下：

  1. extent tree could be narrower：表示某 inode 的 extent 索引树可被优化以降低结构冗余。此提示通常属于结构优化，不必然意味着数据不可恢复。
  2. directory has no checksum：目录元数据缺少校验信息，随后出现 directory corrupted，表明目录结构损坏。
  3. Salvage? yes：询问是否执行目录内容的挽救与结构重建。
  4. Missing '.'、Missing '..'：目录缺少特殊条目，导致目录自身引用与父目录引用缺失。
  5. Setting filetype ... to 2：将条目类型标记为目录类型（2 表示目录）。
1
2
3
4
5
6
7
8
flowchart TB
    A[fsck检查目录结构] --> B{目录校验/结构是否完整?}
    B --> |否| C[报告directory corrupted]
    C --> D[询问Salvage?]
    D --> |yes| E[重建目录项与引用关系]
    E --> F[补齐'.'与'..'条目]
    F --> G[修复目录项类型与元数据]
    B --> |是| H[继续下一项检查]

3. 修复后引导与残留问题

完成 fsck 后，系统引导进入用户空间。启动日志显示根文件系统为 clean，但出现 AppArmor 服务加载失败。

1
2
3
4
5
6
7
8
flowchart TB
    A[fsck结束] --> B[重启系统]
    B --> C[内核挂载根分区]
    C --> D[/dev/sda5标记clean]
    D --> E[systemd启动服务]
    E --> F{AppArmor profiles加载成功?}
    F --> |否| G[AppArmor服务FAILED]
    F --> |是| H[系统正常进入用户会话]

3.1 启动日志关键行分析

原样引用关键启动日志如下：

1
2
3
4
5
piix4_smbus 0000:00:07.3: SMBus Host Controller not enabled!
sd 32:0:0:0 [sda] Assuming drive cache: write through
sd 32:0:1:0 [sdb] Assuming drive cache: write through
/dev/sda5: clean, 602171/3768320 files, 13423175/15072256 blocks
[FAILED] Failed to start Load AppArmor profiles.

对上述信息可拆分为以下判断：

  1. SMBus Host Controller not enabled：虚拟化硬件探测信息，不必然导致启动失败。
  2. Assuming drive cache: write through：虚拟磁盘缓存策略信息，不必然代表故障。
  3. /dev/sda5: clean ...：文件系统修复后一致性通过。
  4. Failed to start Load AppArmor profiles：用户空间服务阶段存在 AppArmor 配置加载问题。
1
2
3
4
5
6
flowchart TB
    A[systemd启动阶段] --> B[挂载完成并报告clean]
    B --> C[启动AppArmor服务]
    C --> D{加载profiles成功?}
    D --> |否| E[记录FAILED并继续启动]
    D --> |是| F[AppArmor运行中]

4. AppArmor 故障链与包管理系统异常

管理员尝试重启 AppArmor 服务并执行 profile 解析，获得大量语法错误输出。随后进一步发现 dpkg 状态库缺失，导致 apt/dpkg 不可用。

1
2
3
4
5
6
7
8
flowchart TB
    A[发现AppArmor FAILED] --> B[尝试systemctl重启]
    B --> C[服务启动失败]
    C --> D[运行apparmor_parser检查]
    D --> E[大量syntax error输出]
    E --> F[尝试通过apt修复]
    F --> G{dpkg status存在?}
    G --> |否| H[apt整体不可用]

4.1 AppArmor 重启与解析输出（原样引用）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
user@ubuntu:~$ sudo systemctl restart apparmor
[sudo] user的密码： 
Job for apparmor.service failed because the control process exited with error code.
See "systemctl status apparmor.service" and "journalctl -xe" for details.

user@ubuntu:~$ sudo apparmor_parser -r /etc/apparmor.d/*
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/ubuntu-console-email ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/dbus-session-strict ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 9 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/ubuntu-media-players ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 1 ? /etc/apparmor.d/abi in /etc/apparmor.d/abi/2.13 ?AppArmor?????:syntax error, unexpected TOK_CAPABILITY, expecting $end
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/dbus-session-strict ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/dovecot-common ?AppArmor?????:syntax error, unexpected TOK_CAPABILITY, expecting $end
? 5 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/aspell ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 23 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/base ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 16 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/nameservice ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/ibus ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/python ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/mozc ?AppArmor?????:syntax error, unexpected TOK_UNIX, expecting $end
? 23 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/base ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 5 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/vulkan ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 7 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/private-files ?AppArmor?????:syntax error, unexpected TOK_DENY, expecting $end
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/user-write ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 5 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/orbit2 ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/mysql ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/dbus-session-strict ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 5 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/ubuntu-unity7-messaging ?AppArmor?????:syntax error, unexpected TOK_DBUS, expecting $end
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/mdns ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 15 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/consoles ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/user-tmp ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 5 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/nvidia ?AppArmor?????:syntax error, unexpected TOK_CAPABILITY, expecting $end
? 11 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/p11-kit ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 8 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/kde-language-write ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 17 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/authentication ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 7 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/private-files ?AppArmor?????:syntax error, unexpected TOK_DENY, expecting $end
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/dbus-strict ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/wayland ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 5 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/video ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 6 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/dri-common ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
Found reference to variable HOME, but is never declared
? 6 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/dri-common ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/kerberosclient ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 14 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/wutmp ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 5 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/gnupg ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 5 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/mesa ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 15 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/user-download ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 6 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/qt5 ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/likewise ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 9 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/ubuntu-feed-readers ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 16 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/ssl_keys ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 9 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/ubuntu-email ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 11 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/openssl ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/freedesktop.org ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 6 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/qt5-compose-cache-write ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 14 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/php ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 6 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/opencl-common ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 23 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/base ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 6 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/opencl-common ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 14 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/mir ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/dbus-session-strict ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 6 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/kde-icon-cache-write ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 11 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/xad ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 9 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/ubuntu-browsers ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/ruby ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 14 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/enchant ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/ssl_certs ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/nis ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 16 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/nameservice ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 17 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/svn-repositories ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/user-manpages ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/fonts ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 15 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/consoles ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/dbus-strict ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 6 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/dconf ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/dbus-strict ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/cups-client ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/dbus-accessibility-strict ?AppArmor?????:syntax error, unexpected TOK_DBUS, expecting $end
? 15 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/audio ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/ldapclient ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 15 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/consoles ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 5 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/nvidia ?AppArmor?????:syntax error, unexpected TOK_CAPABILITY, expecting $end
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/bash ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_EQUALS or TOK_ADD_ASSIGN
? 6 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/opencl-common ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 23 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/base ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 7 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/dri-enumerate ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/dbus-accessibility-strict ?AppArmor?????:syntax error, unexpected TOK_DBUS, expecting $end
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/smbpass ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/winbind ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/web-data ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/user-mail ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 15 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/xdg-desktop ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 6 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/opencl-common ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 6 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/qt5-settings-write ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 9 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/ubuntu-bittorrent-clients ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 4 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/ubuntu-unity7-launcher ?AppArmor?????:syntax error, unexpected TOK_DBUS, expecting $end
? 6 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/kde-globals-write ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
? 12 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/samba ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/perl ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 14 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/php ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 6 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/recent-documents-write ?AppArmor?????:syntax error, unexpected TOK_OWNER, expecting $end
Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
? 23 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/base ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 6 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/opencl-common ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
Skipping profile in /etc/apparmor.d/disable: usr.bin.firefox
? 14 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/postfix-common ?AppArmor?????:syntax error, unexpected TOK_CAPABILITY, expecting $end
? 13 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/ubuntu-console-browsers ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
? 23 ? /etc/apparmor.d/abstractions in /etc/apparmor.d/abstractions/base ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
Skipping profile in /etc/apparmor.d/disable: usr.bin.firefox
? 3 ? /etc/apparmor.d/samba in /etc/apparmor.d/samba/smbd-shares ?AppArmor?????:syntax error, unexpected TOK_MODE, expecting TOK_OPEN
Skipping profile in /etc/apparmor.d/disable: usr.bin.firefox
? 13 ? /etc/apparmor.d/usr.lib.snapd.snap-confine.real in /etc/apparmor.d/usr.lib.snapd.snap-confine.real ?AppArmor?????:????"/var/lib/snapd/apparmor/snap-confine"
Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd

基于该输出，可以得到两个可操作判断：

  1. 解析目标包含 abstractions/ 等片段文件时，会产生大量语法错误输出；这些输出可用于定位环境异常，但不等同于每个片段文件均为独立可加载 profile。
  2. 输出末尾出现对 /var/lib/snapd/apparmor/snap-confine 的引用与缺失，提示 snapd/AppArmor 相关文件集存在缺失或系统包状态异常。
1
2
3
4
5
flowchart TB
    A[运行apparmor_parser -r /etc/apparmor.d/*] --> B[包含abstractions片段文件]
    B --> C[产生大量syntax error输出]
    C --> D[观察到snap-confine引用异常]
    D --> E[推断包状态/文件集完整性问题]

4.2 dpkg 状态库缺失的直接证据

管理员执行以下命令检查 dpkg 状态文件与目录，输出表明 /var/lib/dpkg/ 关键结构缺失：

1
2
3
4
user@ubuntu:~$ ls -l /var/lib/dpkg/status /var/lib/dpkg/status-old /var/lib/dpkg/updates | cat
ls: 无法访问 '/var/lib/dpkg/status': 没有那个文件或目录
ls: 无法访问 '/var/lib/dpkg/status-old': 没有那个文件或目录
ls: 无法访问 '/var/lib/dpkg/updates': 没有那个文件或目录

dpkg 状态库缺失直接导致 apt 无法正常解析软件包状态，并出现以下错误提示（原样引用）：

1
2
E: flAbsPath on /var/lib/dpkg/status failed - realpath (2: No such file or directory)
E: The package lists or status file could not be parsed or opened.
1
2
3
4
5
flowchart TB
    A[尝试使用apt修复AppArmor/snapd] --> B[apt读取/var/lib/dpkg/status]
    B --> C{status存在?}
    C --> |否| D[apt报错并终止]
    C --> |是| E[进入正常安装/修复流程]

5. 修复策略对比与快照回滚决策

在 dpkg 状态库缺失的条件下，常规包管理修复路径失效。此时存在两类策略：

  1. 手动重建 dpkg 数据库结构并尝试恢复包状态。
  2. 备份数据并重装系统，或直接回滚虚拟机快照。

本案例中管理员存在可用快照，因此选择快照回滚。

1
2
3
4
5
6
flowchart TB
    A[发现dpkg状态库缺失] --> B{是否有可用快照?}
    B --> |有| C[回滚到损坏发生前快照]
    B --> |无| D{是否接受重装?}
    D --> |是| E[备份数据并重装Ubuntu]
    D --> |否| F[尝试重建dpkg数据库并硬修]

5.1 快照回滚的工程合理性

快照回滚具备以下工程属性：

  • 对虚拟磁盘与系统状态进行一致性回退。
  • 可在短时间内恢复到一个已验证可启动且可维护的系统状态。
  • 相对于在 dpkg 状态库缺失条件下进行硬修，快照回滚的风险更低、可预测性更强。
1
2
3
4
5
6
flowchart TB
    A[选择快照回滚] --> B[关闭虚拟机]
    B --> C[选择故障前快照]
    C --> D[执行恢复]
    D --> E[启动并验证系统]
    E --> F[验证dpkg/apt与关键服务正常]

6. 结论

本案例的故障链可总结为：

  1. 非正常关机导致 ext4 根文件系统元数据不一致。
  2. 系统启动进入 initramfs，要求手动 fsck 修复。
  3. fsck 修复目录结构与相关元数据后，根文件系统恢复为 clean。
  4. 用户空间阶段出现 AppArmor profiles 加载失败。
  5. 进一步排查发现 dpkg 状态库缺失，导致 apt/dpkg 修复路径失效。
  6. 由于存在虚拟机快照，采用快照回滚恢复到故障前状态，作为最终恢复策略。
1
2
3
4
5
6
7
8
9
10
11
flowchart LR
    A[非正常关机] --> B[ext4元数据不一致]
    B --> C[进入initramfs并要求fsck]
    C --> D[fsck修复目录与元数据]
    D --> E[系统启动并报告/dev/sda5 clean]
    E --> F[AppArmor服务FAILED]
    F --> G[发现dpkg状态库缺失]
    G --> H{恢复策略}
    H --> I[快照回滚]
    H --> J[重装或硬修]
    I --> K[系统恢复为可维护状态]