Hi,

apparmor 5.0 ships /etc/apparmor.d/tunables/ntpd with a compatible
configuration format (same variable name).

This triggered a conffile conflict (#1152663) which makes ntpsec and apparmor
not co-installable at the moment. Sorry I did not spot that before uploading!
(I'm going to add ntpsec to the "test-installed" autopkgtest in src:apparmor so this gets spotted next time.)

It seems to me the best way forward is that ntpsec stops shipping that conffile:
there's nothing specific to ntpsec in there, and the filename clearly belongs to
a namespace that is broader than just ntpsec, so it makes sense it's shipped in
a more central package, and can be shared by AppArmor profiles for various
NTP implementations.

So I propose we do this:

1. ntpsec stops shipping /etc/apparmor.d/tunables/ntpd, presumably in 1.2.5+dfsg-2

   I don't think you need to add a dependency (stronger than the existing
   Suggests:) on apparmor: the apparmor package ships the parser, so without the
   tunable, there's no parser, and then no change your policy depends on
   a missing tunable.

   The attached untested patch should do most, if not all, that's needed.

2. apparmor takes over the conffile:

      Breaks: ntpsec (<< 1.2.5+dfsg-2~)
      Replaces: ntpsec (<< 1.2.5+dfsg-2~)

   I'll do that once (1) has happened.

What do you think?

Hi,

Bas Couwenberg (2026-10-31):

Thanks for the bug report!

Agreed. I've filed #1152846 (with an untested patch) to start
implementing the latter.

Cheers,