Christian is right and this is precisely why dh_apparmor intentionally
does not unload the profile. Marking the apparmor task as Won't Fix
since this has been discussed several times in the past (if apparmor
upstream wants to revisit, we can open the bug).
The ntp package is still in a position to unload the profile if it
desires, so leaving its task open, but I believe this would be a mistake
and if done in Ubuntu, I would file a bug requesting the previous
behavior.
I don't particularly care for the openntpd kludge, but you can unload a
profile that was deleted from disk with:
sudo sh -c 'echo -n /usr/sbin/ntpd >
/sys/kernel/security/apparmor/.remove'
(note, the '-n' with echo is important).
** Changed in: apparmor (Ubuntu)
Status: New => Won't Fix
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1689585
Title:
ntp doesn't unload its apparmor profile on purge
Status in apparmor package in Ubuntu:
Won't Fix
Status in ntp package in Ubuntu:
Confirmed
Bug description:
Steps to reproduce:
1) install ntp
apt install ntp
2) confirm it has loaded its AA profile
aa-status | grep ntpd
3) purge ntp
apt purge ntp
4) the profile is left behind but shouldn't
aa-status | grep ntpd
Additional info:
This was found by first install ntp then changing my mind and deciding to go
with OpenNTPD.
FYI, just installing openntpd while ntp is still there works because openntpd
has a kludge
to unload ntpd's profile but that only works if the ntp package wasn't purged
before.
/var/lib/dpkg/info/openntpd.preinst:
if [ -f /etc/apparmor.d/usr.sbin.ntpd ] && pathfind apparmor_parser ; then
apparmor_parser -R /etc/apparmor.d/usr.sbin.ntpd
fi
Since a purge deletes /etc/apparmor.d/usr.sbin.ntpd, openntpd.preinst's
kludge is ineffective.
In any case, having implementation B include workaround for implementation A
not cleaning up
after itself seems wrong and the issue should be fixed at the source IMHO.
# lsb_release -rd
Description: Ubuntu 16.04.2 LTS
Release: 16.04
# apt-cache policy ntp
ntp:
Installed: 1:4.2.8p4+dfsg-3ubuntu5.4
Candidate: 1:4.2.8p4+dfsg-3ubuntu5.4
Version table:
*** 1:4.2.8p4+dfsg-3ubuntu5.4 500
500 http://archive.ubuntu.com/ubuntu xenial-updates/main amd64
Packages
100 /var/lib/dpkg/status
1:4.2.8p4+dfsg-3ubuntu5.3 500
500 http://security.ubuntu.com/ubuntu xenial-security/main amd64
Packages
1:4.2.8p4+dfsg-3ubuntu5 500
500 http://archive.ubuntu.com/ubuntu xenial/main amd64 Packages
ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: ntp (not installed)
ProcVersionSignature: Ubuntu 4.4.0-78.99-generic 4.4.62
Uname: Linux 4.4.0-78-generic x86_64
ApportVersion: 2.20.1-0ubuntu2.5
Architecture: amd64
Date: Tue May 9 15:48:42 2017
ProcEnviron:
TERM=xterm
PATH=(custom, no user)
LANG=en_US.UTF-8
SourcePackage: ntp
UpgradeStatus: No upgrade log present (probably fresh install)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1689585/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
