Package: ntpsec Version: 1.2.5+dfsg-1 Severity: serious Tags: patch Justification: package uninstallable in most common configurations
Hi,
apparmor 5.0 ships /etc/apparmor.d/tunables/ntpd with a compatible
configuration format (same variable name).
This triggered a conffile conflict (#1152663) which makes ntpsec and apparmor
not co-installable at the moment. Sorry I did not spot that before uploading!
(I'm going to add ntpsec to the "test-installed" autopkgtest in src:apparmor so
this gets spotted next time.)
It seems to me the best way forward is that ntpsec stops shipping that conffile:
there's nothing specific to ntpsec in there, and the filename clearly belongs to
a namespace that is broader than just ntpsec, so it makes sense it's shipped in
a more central package, and can be shared by AppArmor profiles for various
NTP implementations.
So I propose we do this:
1. ntpsec stops shipping /etc/apparmor.d/tunables/ntpd, presumably in
1.2.5+dfsg-2
I don't think you need to add a dependency (stronger than the existing
Suggests:) on apparmor: the apparmor package ships the parser, so without the
tunable, there's no parser, and then no change your policy depends on
a missing tunable.
The attached untested patch should do most, if not all, that's needed.
2. apparmor takes over the conffile:
Breaks: ntpsec (<< 1.2.5+dfsg-2~)
Replaces: ntpsec (<< 1.2.5+dfsg-2~)
I'll do that once (1) has happened.
What do you think?
0001-Stop-shipping-etc-apparmor.d-tunables-ntpd-1152663.patch
Description: application/mbox
