In /etc/apparmor.d, sbin.dhclient was renamed to usr.sbin.dhclient,
so I suppose that the same rename should be done in
/etc/apparmor.d/local (this is like that for the other files
in /etc/apparmor.d/local). And in /etc/apparmor.d/usr.sbin.dhclient,

  #include <local/sbin.dhclient>

should be changed to

  #include <local/usr.sbin.dhclient>

as this yields a broken configuration if the dhclient files had
been removed before the upgrade (seen on one of my machines).

Hi,

At first glance, given how dh_apparmor manages the snippets in
/etc/apparmor.d/local, it may not be trivial to rename the
/etc/apparmor.d/local/sbin.dhclient file, so I agree with the initial
wishlist severity.

However if the inconsistency indeed causes RC-buggy behavior,
maybe it's worth doing:

Vincent Lefevre (2025-04-18):

I suspect the maintainers will need more info here, such as:

What dhclient files have been removed before the upgrade?

How were they removed?

Can you please describe how the resulting configuration is broken?

Cheers,

/etc/apparmor.d/sbin.dhclient
/etc/apparmor.d/local/sbin.dhclient

With "rm".

After the upgrade, I just have

cventin:~> ll /etc/apparmor.d/**/*dhclient*
-rw-r--r-- 1 root root 3590 2025-04-04 16:49:15 /etc/apparmor.d/usr.sbin.dhclient

The one under /etc/apparmor.d/local is absent, though
/etc/apparmor.d/usr.sbin.dhclient does

  #include <local/sbin.dhclient>

(without 'if exists').

Hi,

Vincent Lefevre (2025-04-19):
manually deleted a file (/etc/apparmor.d/local/sbin.dhclient) created
by maintainer scripts. I'm not the maintainer so this is just my
personal opinion.

I think the maintainers will want to know what's the actual impact
of this.

I suppose it makes apparmor.service fail to start?
Anything else?

Indeed, using "if exists" would help here.

Cheers,

Hi,

I disagree. It is the right of the user to remove configuration files,
as long as this is done in a consistent way. Packages must be able to
cope with that (re-adding the main file but not the associated local
one is not correct).

No, I don't see any error with apparmor.service (and the documentation
does not suggest that there would be a fatal error for that).

The apparmor.d(5) man page says:

  The  leading  '#'  is  optional,  and  the  '#include' keyword can be
  followed by an option conditional 'if exists' that specifies  profile
  compilation should continue if the specified file or directory is not
  found.

So, a missing file without "if exists" would stop the compilation of
the profile. I don't know what this implies in practice.

The file was renamed back in 4.4.3-P1-7. Lowering severity, as
supposedly the situation caused by the rename should only affect
unstable users.

Chris

Hi,

I think this issue is Severity: serious because if the isc-dhcp-client
is installed on a *fresh* Trixie installation, the
/etc/apparmor.d/local/sbin.dhclient file is never created but is still
referenced by the /etc/apparmor.d/usr.sbin.dhclient file, which causes
the apparmor service to crash. This MR should hopefully fix it:

https://salsa.debian.org/debian/isc-dhcp/-/merge_requests/16

I have tested this in a fresh VM for both upgrades and fresh
installations and everything seems to work as expected.

Best regards

Alexander Kurtz

service or might have looked at the logs on another machine). Here's
the error I can see in the journalctl output:

May 09 12:13:00 cventin apparmor.systemd[872]: AppArmor parser error for /etc/apparmor.d in profile /etc/apparmor.d/usr.sbin.dhclient at line 76: Could not open 'local/sbin.dhclient'
May 09 12:13:01 cventin apparmor.systemd[736]: Error: At least one profile failed to load
May 09 12:13:01 cventin systemd[1]: apparmor.service: Main process exited, code=exited, status=1/FAILURE
May 09 12:13:01 cventin systemd[1]: apparmor.service: Failed with result 'exit-code'.
May 09 12:13:01 cventin systemd[1]: Failed to start apparmor.service - Load AppArmor profiles.
May 09 12:13:01 cventin systemd[1]: apparmor.service: Consumed 1.495s CPU time, 47.8M memory peak.

We believe that the bug you reported is fixed in the latest version of
isc-dhcp, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1103503@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Kurtz <alexander@kurtz.be> (supplier of updated isc-dhcp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 03 May 2025 19:16:14 +0200
Source: isc-dhcp
Architecture: source
Version: 4.4.3-P1-8
Distribution: unstable
Urgency: medium
Maintainer: Debian ISC DHCP Maintainers <isc-dhcp@packages.debian.org>
Changed-By: Alexander Kurtz <alexander@kurtz.be>
Closes: 1103503
Changes:
 isc-dhcp (4.4.3-P1-8) unstable; urgency=medium
 .
   * Rename /etc/apparmor.d/local/sbin.dhclient conffile (Closes: #1103503)
Checksums-Sha1:
 6cacf4740d72d5878e08622980320fca90fcb5ad 2863 isc-dhcp_4.4.3-P1-8.dsc
 3f27c0d05b585b97c2440477221830c8c311667a 105604 isc-dhcp_4.4.3-P1-8.debian.tar.xz
 d5253897f58a187fae348e114a3f7d78005db37f 10629 isc-dhcp_4.4.3-P1-8_arm64.buildinfo
Checksums-Sha256:
 8f11305d0d978e60114f596615b2cd605004802bb42587a95bf0806211880723 2863 isc-dhcp_4.4.3-P1-8.dsc
 94a64c7cb2749e1f911fcafde72fdbac0d5676dae3b4c85eb1231e65c5973e0d 105604 isc-dhcp_4.4.3-P1-8.debian.tar.xz
 6ee54baba2fcc1047ed37daecb4696738e50b429ecfe5808bc216fe7d79fc967 10629 isc-dhcp_4.4.3-P1-8_arm64.buildinfo
Files:
 56bdd68eeeb8d1ab760eae31bff40382 2863 net important isc-dhcp_4.4.3-P1-8.dsc
 02d24eca1aa653789dd33b93eaa80d5c 105604 net important isc-dhcp_4.4.3-P1-8.debian.tar.xz
 9d79070a2e803729b7fd7f1cba9f8669 10629 net important isc-dhcp_4.4.3-P1-8_arm64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEfRrP+tnggGycTNOSXBPW25MFLgMFAmh4KvQACgkQXBPW25MF
LgMp1w/+IAEoCs1ifLy8E9KvbEfefaw2TuqEp7FXeHzkO+z97Xzf49KFB8FlIFM1
nqehtAHvSDtPgIMRfXN6i0Pr/h8U9XjmwifeiUbg8pGwZqhO58IMAxlFXbhfG1HB
RBD1JOb0qjnUBNmrKZV5CbwnbTtFrDfFpliJzBV9w+3ee7x0jN7ZOzytQGKwDmfX
IeSLiO4EvItxz8l3UAnSk/E7pxeFBIMvksVrZiJFuzVHz/tOmmcnf+SonkemUWSf
xL+Zgx946S+/4Bz371E8VKNv6p/tZ20aGadf6Lq4riHUbwYfStnXVDMepBS3Zve7
/3aHR0rPwjOxUiCOnovvy76SguChuy29bTItim9V5ElQjeApuCJdO79t/aXRf1Nf
fQt1Ty+VVAxkFVzHHl6fpx6bxPmkAK0xWC6pvCMtmc+FGcREv07bMjAya60PJpf4
FfP3zcWFMmd/7WJ9BDor16BspO5yS0uE4WkuDoZ225rKWM9vF7bb4JWGQcGiwe6N
TUaRDFNGPI1tdGucdmvcEn6YodpZs8iF6vIG7g/ts1i0DMJlpJ8MLFqxxKXns/61
e/KsHcWbu5k03f2YBmVJ4Nq/tYvstIzvhDVcgOfUVWDEombOeS02STS63G9Gk/y0
7bTTMz51d7HJ+3wbws1rKnNyP9vw6mWmCr5AgO/NR0sd9U4kAeM=
=Rklt
-----END PGP SIGNATURE-----