"Asking someone to know about that: echo -n "<profile_name>" > /sys/kernel/security/apparmor/.remove
Is asking too much IMHO and increases the friction between sysadmins and Apparmor in general." Of course. I listed this as something that could be considered for the openntpd/ntpd case, not for a sysadmin. This is a corner case that should be coordinated between these packages. In all cases except this rare corner case, it is totally fine (and correct) to leave the profile loaded until next reboot and sysadmins don't have to care about this at all. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1689585 Title: ntp doesn't unload its apparmor profile on purge Status in apparmor package in Ubuntu: Won't Fix Status in ntp package in Ubuntu: Confirmed Bug description: Steps to reproduce: 1) install ntp apt install ntp 2) confirm it has loaded its AA profile aa-status | grep ntpd 3) purge ntp apt purge ntp 4) the profile is left behind but shouldn't aa-status | grep ntpd Additional info: This was found by first install ntp then changing my mind and deciding to go with OpenNTPD. FYI, just installing openntpd while ntp is still there works because openntpd has a kludge to unload ntpd's profile but that only works if the ntp package wasn't purged before. /var/lib/dpkg/info/openntpd.preinst: if [ -f /etc/apparmor.d/usr.sbin.ntpd ] && pathfind apparmor_parser ; then apparmor_parser -R /etc/apparmor.d/usr.sbin.ntpd fi Since a purge deletes /etc/apparmor.d/usr.sbin.ntpd, openntpd.preinst's kludge is ineffective. In any case, having implementation B include workaround for implementation A not cleaning up after itself seems wrong and the issue should be fixed at the source IMHO. # lsb_release -rd Description: Ubuntu 16.04.2 LTS Release: 16.04 # apt-cache policy ntp ntp: Installed: 1:4.2.8p4+dfsg-3ubuntu5.4 Candidate: 1:4.2.8p4+dfsg-3ubuntu5.4 Version table: *** 1:4.2.8p4+dfsg-3ubuntu5.4 500 500 http://archive.ubuntu.com/ubuntu xenial-updates/main amd64 Packages 100 /var/lib/dpkg/status 1:4.2.8p4+dfsg-3ubuntu5.3 500 500 http://security.ubuntu.com/ubuntu xenial-security/main amd64 Packages 1:4.2.8p4+dfsg-3ubuntu5 500 500 http://archive.ubuntu.com/ubuntu xenial/main amd64 Packages ProblemType: Bug DistroRelease: Ubuntu 16.04 Package: ntp (not installed) ProcVersionSignature: Ubuntu 4.4.0-78.99-generic 4.4.62 Uname: Linux 4.4.0-78-generic x86_64 ApportVersion: 2.20.1-0ubuntu2.5 Architecture: amd64 Date: Tue May 9 15:48:42 2017 ProcEnviron: TERM=xterm PATH=(custom, no user) LANG=en_US.UTF-8 SourcePackage: ntp UpgradeStatus: No upgrade log present (probably fresh install) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1689585/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
