complain mode (AppArmor)

The mode in which an AppArmor profile logs accesses outside its rules — and then allows them. It answers one question: is this profile what is making the service fail? You switch with sudo aa-complain /usr/sbin/mysqld, retry the operation, and read journalctl -k. sudo aa-status counts profiles three ways, and the loaded count is the one that misleads: a profile in complain is loaded, appears in the list, and refuses nothing. It protects exactly as much as an absent profile, with the appearance of protection on top. So complain is a step, never a state: write the missing rule into /etc/apparmor.d/local/usr.sbin.mysqld, reload with apparmor_parser -r, then sudo aa-enforce. The line 2 profiles are in complain mode is one to explain, not to read past.