Your message dated Tue, 30 Oct 2018 11:07:54 +0100
with message-id <[email protected]>
and subject line Re: Bug#830502: apparmor-profiles: Reconsider what profiles
are shipped in /etc/apparmor.d/ and in which mode
has caused the Debian Bug report #830502,
regarding apparmor-profiles: Reconsider what profiles are shipped in
/etc/apparmor.d/ and in which mode
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
830502: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=830502
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: apparmor-profiles
Version: 2.10.95-4
Severity: normal
The apparmor-profiles package ships a number of profiles in
/etc/apparmor.d/, "in complain mode so that users can test and choose
which are desired". This includes policy for dovecot, dnsmasq,
avahi-daemon, ping.
This is confusing to some of us, and to users in general. And IIRC
Felix had some concerns about shipping these profiles there as well.
During the team meeting we had at DebConf, several options were
suggested:
a) Move the profiles that are not good enough to be enforced to
a separate package
b) Move the profiles that are not good enough to be enforced to
/usr/share/doc (where we already ship a number of profiles)
Also, it might be that some of these profiles are actually good enough
to be enforced by default, instead of being moved elsewhere.
Apparently, I've volunteered to work on that, but help would be
greatly welcome :)
Next step is to check what other distros (Ubuntu, OpenSUSE) do about
these profiles.
Cheers,
--
intrigeri
--- End Message ---
--- Begin Message ---
Version: 2.12-2
> I lack energy to handle the packaging side of moving files from /etc
> to /usr right now though (conffiles to non-conffiles, sounds scary),
> so in the meantime I took several steps to make the apparmor-profile
> package description more humble and to stop encouraging average users
> to install it at all:
> https://salsa.debian.org/apparmor-team/apparmor/merge_requests/1,
> merged, not uploaded yet. Same on
> https://wiki.debian.org/AppArmor/HowToUse, where I also added warnings
> about the deny rules vs. complain mode problem.
> There's definitely more work to do on this bug but for now I'm happy
> enough with the resulting state of things, that should be vastly more
> sustainable than it used to for me.
I'll leave it at that ⇒ closing.
--- End Message ---
