Complain mode causes haproxy to not start properly

The report gives a full reproduction: on Ubuntu, run aa-autodep and aa-complain on /usr/sbin/haproxy, then systemctl start haproxy, which hangs and never notifies systemd. Start by reproducing that sequence and confirming the audit lines with apparmor="ALLOWED" ... info="failed af match" are what stalls the worker, since the process is running in -Ws master/worker mode with sd_notify readiness. Done means either haproxy reaches active under a complaining profile, or the report is narrowed to a distro AppArmor rule rather than haproxy's own startup or notification code. Two comments over two months left this unresolved and unassigned, so expect to chase the thread.

Detailed Description of the Problem

When I run:
systemctl start haproxy

from a fresh installation, everything works as expected.

If I create an AppArmor profile and set HAProxy in complain mode:
systemctl stop haproxy
aa-autodep /usr/sbin/haproxy
aa-complain /usr/sbin/haproxy
systemctl start haproxy

HAProxy hangs and timeout.
It seems that systemd can't notify the service has started anymore.
Just kill the service and disable AppArmor makes it work again:

aa-disable /usr/sbin/haproxy
systemctl restart haproxy

Expected Behavior

I think HAproxy should work with a complaining AppArmor.

Steps to Reproduce the Behavior

1. Setup a clean Ubuntu 26 LTS version (up to date)

2. Run:
   apt install haproxy -y
   systemctl stop haproxy
   aa-autodep /usr/sbin/haproxy
   aa-complain /usr/sbin/haproxy
   systemctl start haproxy

Do you have any idea what may have caused this?

No response

Do you have an idea how to solve the issue?

No response

What is your configuration?

Didn't input any configuration.
Maybe you need to create an empty /etc/haproxy/haproxy.cfg file.

Output of haproxy -vv

haproxy -vv
HAProxy version 3.2.9-1ubuntu2.2 2026/06/19 - https://haproxy.org/
Status: long-term supported branch - will stop receiving fixes around Q2 2030.
Known bugs: http://www.haproxy.org/bugs/bugs-3.2.9.html
Running on: Linux 7.0.0-27-generic #27-Ubuntu SMP PREEMPT_DYNAMIC Thu Jun 18 19:13:49 UTC 2026 x86_64
Build options :
  TARGET  = linux-glibc
  CC      = x86_64-linux-gnu-gcc
  CFLAGS  = -O2 -g -fwrapv -fvect-cost-model=very-cheap -g -O2 -Werror=implicit-function-declaration -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -flto=auto -ffat-lto-objects -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -fdebug-prefix-map=/build/haproxy-Gbjozo/haproxy-3.2.9=/usr/src/haproxy-3.2.9-1ubuntu2.2 -Wdate-time -D_FORTIFY_SOURCE=3
  OPTIONS = USE_OPENSSL=1 USE_LUA=1 USE_SLZ=1 USE_QUIC=1 USE_PROMEX=1 USE_PCRE2=1 USE_PCRE2_JIT=1
  DEBUG   =

Feature list : -51DEGREES +ACCEPT4 +BACKTRACE -CLOSEFROM +CPU_AFFINITY +CRYPT_H -DEVICEATLAS +DL -ENGINE +EPOLL -EVPORTS +GETADDRINFO -KQUEUE -LIBATOMIC +LIBCRYPT +LINUX_CAP +LINUX_SPLICE +LINUX_TPROXY +LUA +MATH -MEMORY_PROFILING +NETFILTER +NS -OBSOLETE_LINKER +OPENSSL -OPENSSL_AWSLC -OPENSSL_WOLFSSL -OT -PCRE +PCRE2 +PCRE2_JIT -PCRE_JIT +POLL +PRCTL -PROCCTL +PROMEX -PTHREAD_EMULATION +QUIC -QUIC_OPENSSL_COMPAT +RT +SLZ +SSL -STATIC_PCRE -STATIC_PCRE2 +TFO +THREAD +THREAD_DUMP +TPROXY -WURFL -ZLIB +ACME

Default settings :
  bufsize = 16384, maxrewrite = 1024, maxpollevents = 200

Built with multi-threading support (MAX_TGROUPS=32, MAX_THREADS=1024, default=3).
Built with SSL library version : OpenSSL 3.5.5 27 Jan 2026
Running on SSL library version : OpenSSL 3.5.5 27 Jan 2026
SSL library supports TLS extensions : yes
SSL library supports SNI : yes
SSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3
OpenSSL providers loaded : default
QUIC: connection socket-owner mode support : yes
QUIC: GSO emission support : yes
Built with Lua version : Lua 5.4.8
Built with the Prometheus exporter as a service
Built with network namespace support.
Built with libslz for stateless compression.
Compression algorithms supported : identity("identity"), deflate("deflate"), raw-deflate("deflate"), gzip("gzip")
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND
Built with PCRE2 version : 10.46 2025-08-27
PCRE2 library supports JIT : yes
Encrypted password support via crypt(3): yes
Built with gcc compiler version 15.2.0

Available polling systems :
      epoll : pref=300,  test result OK
       poll : pref=200,  test result OK
     select : pref=150,  test result OK
Total: 3 (3 usable), will use epoll.

Available multiplexer protocols :
(protocols marked as <default> cannot be specified using 'proto' keyword)
       quic : mode=HTTP  side=FE     mux=QUIC  flags=HTX|NO_UPG|FRAMED
         h2 : mode=HTTP  side=FE|BE  mux=H2    flags=HTX|HOL_RISK|NO_UPG
         h1 : mode=HTTP  side=FE|BE  mux=H1    flags=HTX|NO_UPG
  <default> : mode=HTTP  side=FE|BE  mux=H1    flags=HTX
       fcgi : mode=HTTP  side=BE     mux=FCGI  flags=HTX|HOL_RISK|NO_UPG
       spop : mode=SPOP  side=BE     mux=SPOP  flags=HOL_RISK|NO_UPG
  <default> : mode=SPOP  side=BE     mux=SPOP  flags=HOL_RISK|NO_UPG
       none : mode=TCP   side=FE|BE  mux=PASS  flags=NO_UPG
  <default> : mode=TCP   side=FE|BE  mux=PASS  flags=

Available services : prometheus-exporter
Available filters :
        [BWLIM] bwlim-in
        [BWLIM] bwlim-out
        [CACHE] cache
        [COMP] compression
        [FCGI] fcgi-app
        [SPOE] spoe
        [TRACE] trace

Last Outputs and Backtraces

sudo systemctl status haproxy
● haproxy.service - HAProxy Load Balancer
     Loaded: loaded (/usr/lib/systemd/system/haproxy.service; enabled; preset: enabled)
     Active: activating (start) since Thu 2026-07-23 08:54:59 UTC; 38s ago
        Job: 5812699
 Invocation: 727084fd2cab49fa9716c8fd054c70fd
       Docs: man:haproxy(1)
             file:/usr/share/doc/haproxy/configuration.txt.gz
   Main PID: 709735 (haproxy)
      Tasks: 5 (limit: 10000)
     Memory: 43.8M (peak: 44.1M)
        CPU: 123ms
     CGroup: /system.slice/haproxy.service
             ├─709735 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /run/haproxy-master.sock
             └─709737 /usr/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /run/haproxy-master.sock

Jul 23 08:54:59 MYSERVER systemd[1]: Starting haproxy.service - HAProxy Load Balancer...
Jul 23 08:54:59 MYSERVER haproxy[709735]: [NOTICE]   (709735) : Initializing new worker (709737)
Jul 23 08:55:00 MYSERVER haproxy[709735]: [NOTICE]   (709735) : Loading success.

sudo journalctl | grep haproxy
Jul 23 08:54:53 MYSERVER sudo[709698]: root : TTY=/dev/pts/11 ; PWD=/root ; USER=root ; COMMAND=/usr/sbin/aa-autodep /usr/sbin/haproxy
Jul 23 08:54:54 MYSERVER kernel: audit: type=1400 audit(1784796894.043:359494): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/haproxy" pid=709703 comm="apparmor_parser"
Jul 23 08:54:55 MYSERVER sudo[709713]: root : TTY=/dev/pts/11 ; PWD=/root ; USER=root ; COMMAND=/usr/sbin/aa-complain /usr/sbin/haproxy
Jul 23 08:54:56 MYSERVER kernel: audit: type=1400 audit(1784796896.244:359495): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="/usr/sbin/haproxy" pid=709718 comm="apparmor_parser"
Jul 23 08:54:59 MYSERVER sudo[709730]: root : TTY=/dev/pts/11 ; PWD=/root ; USER=root ; COMMAND=/usr/bin/systemctl start haproxy
Jul 23 08:54:59 MYSERVER systemd[1]: Starting haproxy.service - HAProxy Load Balancer...
Jul 23 08:54:59 MYSERVER kernel: audit: type=1400 audit(1784796899.904:359496): apparmor="ALLOWED" operation="create" class="net" info="failed af match" error=-13 profile="/usr/sbin/haproxy" pid=709735 comm="haproxy" family="inet" sock_type="stream" protocol=0 requested="create" denied="create"
Jul 23 08:54:59 MYSERVER kernel: audit: type=1400 audit(1784796899.904:359497): apparmor="ALLOWED" operation="getsockopt" class="net" info="failed af match" error=-13 profile="/usr/sbin/haproxy" pid=709735 comm="haproxy" family="inet" sock_type="stream" protocol=6 requested="getopt" denied="getopt"
Jul 23 08:54:59 MYSERVER kernel: audit: type=1400 audit(1784796899.904:359498): apparmor="ALLOWED" operation="create" class="net" info="failed af match" error=-13 profile="/usr/sbin/haproxy" pid=709735 comm="haproxy" family="inet6" sock_type="stream" protocol=0 requested="create" denied="create"
Jul 23 08:54:59 MYSERVER kernel: audit: type=1400 audit(1784796899.904:359499): apparmor="ALLOWED" operation="getsockopt" class="net" info="failed af match" error=-13 profile="/usr/sbin/haproxy" pid=709735 comm="haproxy" family="inet6" sock_type="stream" protocol=6 requested="getopt" denied="getopt"
Jul 23 08:54:59 MYSERVER kernel: audit: type=1400 audit(1784796899.904:359500): apparmor="ALLOWED" operation="getsockopt" class="net" info="failed af match" error=-13 profile="/usr/sbin/haproxy" pid=709735 comm="haproxy" family="inet6" sock_type="stream" protocol=6 requested="getopt" denied="getopt"
Jul 23 08:54:59 MYSERVER kernel: audit: type=1400 audit(1784796899.904:359501): apparmor="ALLOWED" operation="create" class="net" info="failed af match" error=-13 profile="/usr/sbin/haproxy" pid=709735 comm="haproxy" family="inet" sock_type="stream" protocol=262 requested="create" denied="create"
Jul 23 08:54:59 MYSERVER kernel: audit: type=1400 audit(1784796899.904:359502): apparmor="ALLOWED" operation="getsockopt" class="net" info="failed af match" error=-13 profile="/usr/sbin/haproxy" pid=709735 comm="haproxy" family="inet" sock_type="stream" protocol=262 requested="getopt" denied="getopt"
Jul 23 08:54:59 MYSERVER kernel: audit: type=1400 audit(1784796899.904:359503): apparmor="ALLOWED" operation="create" class="net" info="failed af match" error=-13 profile="/usr/sbin/haproxy" pid=709735 comm="haproxy" family="inet6" sock_type="stream" protocol=262 requested="create" denied="create"
Jul 23 08:54:59 MYSERVER kernel: audit: type=1400 audit(1784796899.904:359504): apparmor="ALLOWED" operation="getsockopt" class="net" info="failed af match" error=-13 profile="/usr/sbin/haproxy" pid=709735 comm="haproxy" family="inet6" sock_type="stream" protocol=262 requested="getopt" denied="getopt"
Jul 23 08:54:59 MYSERVER kernel: audit: type=1400 audit(1784796899.904:359505): apparmor="ALLOWED" operation="create" class="net" info="failed af match" error=-13 profile="/usr/sbin/haproxy" pid=709735 comm="haproxy" family="inet" sock_type="dgram" protocol=0 requested="create" denied="create"
Jul 23 08:54:59 MYSERVER haproxy[709735]: [NOTICE]   (709735) : Initializing new worker (709737)
Jul 23 08:55:00 MYSERVER haproxy[709735]: [NOTICE]   (709735) : Loading success.

Additional Information

lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 26.04 LTS
Release: 26.04
Codename: resolute

If you need more system information, don't hesitate to request.