/etc/apparmor.d/usr.sbin.mysqld

  /var/lib/mysql/ r,
  /var/lib/mysql/** rwk,
  /nexus/tardis/mysql/** rwk,
  /nexus/tardis/mysql/ r,

This was in response to the following syslog messages:

/var/log/syslog

Apr 12 00:30:59 tardis mysqld[17818]: 080412  0:30:59 [ERROR] /usr/sbin/mysqld: Can't find file: './mysql/host.frm' (errno: 13)
Apr 12 00:30:59 tardis mysqld[17818]: 080412  0:30:59 [ERROR] Fatal error: Can't open and lock privilege tables: Can't find file: './mysql/host.frm' (errno: 13)
Apr 12 00:30:59 tardis kernel: [25185.601980] audit(1207974659.063:36): operation="inode_permission" request_mask="r::" denied_mask="r::" name="/nexus/tardis/mysql/mysql/host.frm" pid=17817 profile="/usr/sbin/mysqld" namespace="default"
Apr 12 00:30:59 tardis kernel: [25185.602018] audit(1207974659.063:37): operation="inode_permission" request_mask="r::" denied_mask="r::" name="/nexus/tardis/mysql/mysql/host.frm" pid=17817 profile="/usr/sbin/mysqld" namespace="default"
Apr 12 00:30:59 tardis mysqld_safe[17823]: ended

Apparently I didn’t see this important message in my.cnf when I was modifying it:

# * IMPORTANT
#   If you make changes to these settings and your system uses apparmor, you may
#   also need to also adjust /etc/apparmor.d/usr.sbin.mysqld.

Then, I went and checked /etc/mysql/debian.cnf for the debian-sys-maint password and set it like so:

GRANT ALL PRIVILEGES ON *.* TO 'debian-sys-maint'@'localhost' IDENTIFIED BY '<that password>' WITH GRANT OPTION;