Bug#893974: apparmor: loads /etc/apparmor.d/*.dpkg-remove

[intrigeri]

Control: tag -1 + upstream

Felix C. Stegerman:
> I noticed that my openntpd service stopped working after apparmor was
> enabled in sid by default.  I finally traced the problem to a
> remaining /etc/apparmor.d/usr.sbin.ntpd.dpkg-remove without 'x'
> permissions for /usr/sbin/ntpd.  It did not immediately occur to me
> that whilst the /etc/apparmor.d/usr.sbin.ntpd config seemed fine, it
> was being overruled by an old .dpkg-remove.

Good catch!

> Not sure what the best way to fix this is, but it seems to me that
> apparmor should probably not load any *.dpkg-remove.

Agreed. I've asked someone who prepared a similar merge request
recently if they would be fine with extending it to cover
*.dpkg-remove too:
https://gitlab.com/apparmor/apparmor/merge_requests/86#note_65780436

If they don't want to, perhaps you could do it yourself?
https://gitlab.com/apparmor/apparmor/merge_requests/86/diffs
should tell you exactly what should be changed and where :)

Cheers!

Bug#893974: apparmor: loads /etc/apparmor.d/*.dpkg-remove

[Felix C. Stegerman]

Package: apparmor
Version: 2.12-4
Severity: normal

Dear Maintainer,

I noticed that my openntpd service stopped working after apparmor was
enabled in sid by default.  I finally traced the problem to a
remaining /etc/apparmor.d/usr.sbin.ntpd.dpkg-remove without 'x'
permissions for /usr/sbin/ntpd.  It did not immediately occur to me
that whilst the /etc/apparmor.d/usr.sbin.ntpd config seemed fine, it
was being overruled by an old .dpkg-remove.

Not sure what the best way to fix this is, but it seems to me that
apparmor should probably not load any *.dpkg-remove.  I've filed a bug
report against openntpd as well for leaving this file behind when it
should have been removed automatically (I believe).

Thanks.

- Felix

-- System Information:
Debian Release: buster/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 4.15.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE= 
(charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apparmor depends on:
ii  debconf [debconf-2.0]  1.5.66
ii  libc6  2.27-2
ii  lsb-base   9.20170808
ii  python33.6.4-1

apparmor recommends no packages.

Versions of packages apparmor suggests:
pn  apparmor-profiles-extra  
pn  apparmor-utils   

-- debconf information excluded