Hi,

Currectly, the apparmor-profiles-extra package includes a profile for
apt-cacher-ng (/etc/apparmor.d/usr.sbin.apt-cacher-ng)

IMVHO, it would be better if it was included (and maintained) directly
inside the apt-cacher-ng.

Could you please see at moving the profile in this package?

Kind regards,

Laurent Bigonville

Hallo,
* Laurent Bigonville [Tue, Jul 16 2019, 11:55:52AM]:

Yes.

In case you have instructions on the proper process to get this fixed,
please let me know. Just creating a replacement for their conffile feels
like the wrong way to go.

Some apparmor weirdness has hit me on one of my systems recently and I
would like to have it solved properly. I worked around that with
/etc/apparmor.d/local/usr.sbin.apt-cacher-ng for now but it's messy.

I actually don't like apparmor people secretly creating a profile for
apt-cacher-ng instead of telling the maintainer to fix it properly. On
the other hand, apparmor maintenance seems to be a case for the MIA
team, their contact address is still an Alioth mailing list.

Best regards,
Eduard.

Hi,

Eduard Bloch (2021-05-24):

Sure.

The operations involved don't meet the freeze policy, so we'll have to
wait until Bullseye is released.

tl;dr:

 - Import and install an AppArmor profile.

   I would suggest the profile that's maintained upstream
   as a cross-distribution effort there:
https://gitlab.com/apparmor/apparmor-profiles
   … but that's obviously your call.

 - Do the usual "take over a conffile from another package" dance: add
   Breaks+Replaces against the first version of
   apparmor-profiles-extra that won't ship the apt-cacher-ng profile
   anymore (ideally with "~" appended). We'll need to coordinate.

 - Add build-depends on dh-apparmor

 - Add a call to dh_apparmor in debian/rules.

You'll find full, real-life examples in tcpdump 4.9.0-3, ntp
4.2.8p7+dfsg-1, and evince 3.20.0-2: they all took over AppArmor
profiles that used to be shipped in apparmor-profiles-extra,
which is great.

To me it looks like you're jumping to rather drastic conclusions a bit
too hastily here.

FYI, the mailing list you're referring to works just fine. A number of
important and active teams in Debian have chosen to do the same.
For example, it's hard to argue that the Debian Perl group is a case
for the MIA team. It's true, however, that the Alioth mailing list
continuation project is not meant to live forever. We'll cross that
bridge once we get there.

The number of uploads you'll see there should hopefully reassure you
regarding MIA status of the AppArmor team:

https://tracker.debian.org/pkg/apparmor
https://tracker.debian.org/pkg/apparmor-profiles-extra

(To be honest, this team currently has only 2 active people, each
quite specialized, so like many other teams in Debian it's not
awesomely sustainable. Oh well.)

Cheers!