On 2017-05-12 02:15 PM, Christian Boltz wrote: > You are technically correct that the still-loaded profile doesn't > match a clean uninstall. However, I have a different opinion on this > and thing keeping the profile loaded is the better choice. > > Unloading a profile means removing the confinement from running > processes. So if a process is still running and (Hi Murphy!) does > something bad after being uninstalled and becoming unconfined, you > are screwed up.
If purging a package doesn't kill the running process, that's a packaging bug, not something Apparmor should try to paper over, IMHO. > If the profile stays loaded, still running processes stay confined. > The disadvantages are a) you waste some bytes in the RAM and b) if > you install a different package shipping a binary with the same path, > but without an AppArmor profile, it will suffer from the > still-loaded profile. Asking someone to know about that: echo -n "<profile_name>" > /sys/kernel/security/apparmor/.remove Is asking too much IMHO and increases the friction between sysadmins and Apparmor in general. The colleague that experience the issue was about to do an Apparmor teardown to get going... > Both ways are not perfect, but I really prefer keeping the profile > loaded because it does less harm. > > > For comparison: Does the uninstall script also run "killall -9 ntp"? > If so, feel free to unload the profile ;-) I still think that having dh_apparmor do the unload is the best way :) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1689585 Title: ntp doesn't unload its apparmor profile on purge Status in apparmor package in Ubuntu: Won't Fix Status in ntp package in Ubuntu: Confirmed Bug description: Steps to reproduce: 1) install ntp apt install ntp 2) confirm it has loaded its AA profile aa-status | grep ntpd 3) purge ntp apt purge ntp 4) the profile is left behind but shouldn't aa-status | grep ntpd Additional info: This was found by first install ntp then changing my mind and deciding to go with OpenNTPD. FYI, just installing openntpd while ntp is still there works because openntpd has a kludge to unload ntpd's profile but that only works if the ntp package wasn't purged before. /var/lib/dpkg/info/openntpd.preinst: if [ -f /etc/apparmor.d/usr.sbin.ntpd ] && pathfind apparmor_parser ; then apparmor_parser -R /etc/apparmor.d/usr.sbin.ntpd fi Since a purge deletes /etc/apparmor.d/usr.sbin.ntpd, openntpd.preinst's kludge is ineffective. In any case, having implementation B include workaround for implementation A not cleaning up after itself seems wrong and the issue should be fixed at the source IMHO. # lsb_release -rd Description: Ubuntu 16.04.2 LTS Release: 16.04 # apt-cache policy ntp ntp: Installed: 1:4.2.8p4+dfsg-3ubuntu5.4 Candidate: 1:4.2.8p4+dfsg-3ubuntu5.4 Version table: *** 1:4.2.8p4+dfsg-3ubuntu5.4 500 500 http://archive.ubuntu.com/ubuntu xenial-updates/main amd64 Packages 100 /var/lib/dpkg/status 1:4.2.8p4+dfsg-3ubuntu5.3 500 500 http://security.ubuntu.com/ubuntu xenial-security/main amd64 Packages 1:4.2.8p4+dfsg-3ubuntu5 500 500 http://archive.ubuntu.com/ubuntu xenial/main amd64 Packages ProblemType: Bug DistroRelease: Ubuntu 16.04 Package: ntp (not installed) ProcVersionSignature: Ubuntu 4.4.0-78.99-generic 4.4.62 Uname: Linux 4.4.0-78-generic x86_64 ApportVersion: 2.20.1-0ubuntu2.5 Architecture: amd64 Date: Tue May 9 15:48:42 2017 ProcEnviron: TERM=xterm PATH=(custom, no user) LANG=en_US.UTF-8 SourcePackage: ntp UpgradeStatus: No upgrade log present (probably fresh install) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1689585/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
