Hi,

libreoffice-common 1:5.4.4-1 stopped disabling all profiles but the
oosplash and soffice.bin profiles are still shipped in complain mode.
This bug report is meant to track and discuss what needs to be done to
ship them in enforce mode instead. See #883800 for the beginning of
this conversation.

The remaining blocker seems to be autopkgtests being broken by
AppArmor, due to using custom paths:

René Engelhard wrote:


How about this:

1. Add the needs-root restriction to debian/tests/control (and
   possibly the breaks-testbed restriction too if we cannot reliably
   revert the following changes after running the tests).

2. Wrap the test cases with code that modifies the @{libo_user_dirs}
   AppArmor profile variable to include the place where the test cases
   will store their custom data directories, and then reloads the
   affected AppArmor profile.

Another option is to do (1) but instead of (2), disable the AppArmor
profiles that break the test suite. It would obviously be cheaper and
more reliable, and I'd be happy to give it a try (no big hurry
though). But it won't exercise the AppArmor policy contrary to the
solution proposed above. But surely it would be a nice first iteration
until someone feels like implementing the more advanced solution
proposed above.

What do you think?

Cheers,

Hi,

Bascially anything which needs "custom" paths. Another incarnation of
this was https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884747

And run the tests as root?

That would probably work, but still cause #884747 (and whatever else still
unreported).

Regards,

Rene

Note that ubuntu accidentally shipped the apparmor profiles in enforce
mode for 5.4.5 on 17.10 as part of a stable release update, and we
have been getting rather negative feedback as this broke numerous real
use cases. See https://launchpad.net/bugs/1751005.

[ I know this, maybe you should Cc the submitter? nnn@bugs.debian.org does
NOT go to the submitter ]

Hi,
some of things in this bug is, yes..

But yeah, stuff like this is what I meant in previous replies.

There's also

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=887593
(mostly fixed, except the OpenCL stuff, firefox 58 - cert9 - support not yet
uploaded, pdfimport w support and "File -> Sign existing PDF" probably also is
still broken. )

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882597
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884747
(closed since it went from enforce to disabled)

And all the other fixes (mozilla, gpg, your senddoc fixes, ..) were never
backported to 5.4.x anyways, I only maintain 6.x by now. :)

Regards,

Rene

[ I know this, maybe you should Cc the submitter? nnn@bugs.debian.org does
NOT go to the submitter ]

Hi,
some of things in this bug is, yes..

But yeah, stuff like this is what I meant in previous replies.

There's also

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=887593
(mostly fixed, except the OpenCL stuff, firefox 58 - cert9 - support not yet
uploaded, pdfimport w support and "File -> Sign existing PDF" probably also is
still broken. )

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882597
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884747
(closed since it went from enforce to disabled)

And all the other fixes (mozilla, gpg, your senddoc fixes, ..) were never
backported to 5.4.x anyways, I only maintain 6.x by now. :)

Regards,

Rene

Dear submitter,

as the package libreoffice has just been removed from the Debian archive
experimental we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/1069123

The version of this package that was in Debian prior to this removal
can still be found using https://snapshot.debian.org/.

Please note that the changes have been done on the master archive and
will not propagate to any mirrors until the next dinstall run at the
earliest.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)

Humanitarian Grant of 1.5M for you. Reply for claims