1. Forum
  2. Usenet
  3. LINUX.DEBIAN.BUGS.DIST

  • Bug#1110149: ejabberd breaks apparmor after upgrade (bookworm -> trixie

    From Philipp Huebner@21:1/5 to All on Fri Aug 1 15:50:01 2025
    Hi,

    ejabberd in Debian Trixie no longer ships any apparmor profile,
    the upgrade process should have removed that or at least asked you.

    Any idea why it's still in place for you? Did you suppress / reject any question regarding this during the upgrade?

    Maybe we should add a forced removal in debian/postinst to be on the
    safe side.

    Regards
    --
    ⢀⣴⠾⠻⢶⣦⠀
    ⣾⠁⢠⠒⠀⣿⡁ Philipp Huebner <[email protected]> ⢿⡄⠘⠷⠚⠋⠀ OpenPGP: 671925C5B8CDE74A52253DF9E5CA8C4925E4205F ⠈⠳⣄


    <html><head></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div>Hi,</div><div><br></div><div>ejabberd in Debian Trixie no longer ships any apparmor profile,<br>the upgrade process should have
    removed that or at least asked you.</div><div><br></div><div>Any idea why it's still in place for you? Did you suppress / reject any question regarding this during the upgrade?</div><div><br></div><div>Maybe we should add a forced removal in debian/
    postinst to be on the safe side.</div><div><br></div><div>Regards</div><div><span><pre>-- <br></pre><pre> ⢀⣴⠾⠻⢶⣦⠀
    ⣾⠁⢠⠒⠀⣿⡁ Philipp Huebner &lt;[email protected]&gt;
    ⢿⡄⠘⠷⠚⠋⠀ OpenPGP: 671925C5B8CDE74A52253DF9E5CA8C4925E4205F
    ⠈⠳⣄

    </pre></span></div></body></html>

    --- SoupGate-Win32
  • From Gerald Turner@21:1/5 to Philipp Huebner on Fri Aug 1 18:10:01 2025
    On Fri, Aug 01 2025, Philipp Huebner wrote:
    ejabberd in Debian Trixie no longer ships any apparmor profile,
    the upgrade process should have removed that or at least asked you.

    Any idea why it's still in place for you? Did you suppress / reject
    any question regarding this during the upgrade?

    Maybe we should add a forced removal in debian/postinst to be on the
    safe side.

    I checked /var/log/apt/term.log - no output or prompts about the
    profile. Both apparmor and ejabberd packages were upgraded in the same
    run, along with 1,000 other packages.

    I use etckeeper, therefore I can see that I had modified the profile
    starting all the way back in 2019. IIRC, I've had issues with the
    ejabberd's apparmor profile vs. munin-node monitoring scripts, getting
    denials when connecting to ejabberd to poll stats. BTW, most these modifications were done in /etc/apparmor.d/local/usr.sbin.ejabberdctl.

    This is odd:

    $ grep apparmor /var/lib/dpkg/info/ejabberd.list
    /etc/apparmor.d/usr.sbin.ejabberdctl

    I didn't realize that the /var/lib/dpkg/info/*.list files were dynamic.
    I assumed they would match:

    https://packages.debian.org/trixie/amd64/ejabberd/filelist

    The tail end of the .list file contains these entries, where it deviates
    from what is displayed on packages.d.o:

    /var
    /var/lib
    /var/lib/ejabberd
    /var/log
    /var/log/ejabberd
    /etc/ejabberd/ejabberdctl.cfg
    /usr/lib/x86_64-linux-gnu/ejabberd-24.12
    /usr/lib/x86_64-linux-gnu/ejabberd-24.12-3/priv/img
    /usr/share/doc/ejabberd/examples/captcha.sh
    /usr/share/doc/ejabberd/examples/ejabberd.yml
    /usr/share/doc/ejabberd/examples/ejabberdctl.cfg
    /etc/default/ejabberd
    /etc/apparmor.d/usr.sbin.ejabberdctl

    This host has been running ejabberd since 2.1.5-1 which might explain
    some of the cruft.

    --
    Gerald Turner <[email protected]> Encrypted mail preferred!
    OpenPGP: 4096R / CA89 B27A 30FA 66C5 1B80 3858 EC94 2276 FDB8 716D

    --=-=-Content-Type: application/pgp-signature; name="signature.asc"

    -----BEGIN PGP SIGNATURE-----

    iQKTBAEBCgB9FiEEJIXNbSMPbqfSloTGvKAfB3Gpb80FAmiM4yBfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDI0 ODVDRDZEMjMwRjZFQTdEMjk2ODRDNkJDQTAxRjA3NzFBOTZGQ0QACgkQvKAfB3Gp b83JTg//cu+HHYUBU96/F19aeKHDPJGKgjOVlYi4Bmlnk9YxaxfR8u4sCz/aNgdN CGfUKpq+0HjfVeQq2WdPmp2OvXauZJwDl1pKfWM5Gp1K36F79/1m+RgDwVrx+gAd wD5eNEFQdvNGOw6mzy/rWuPuXKPW87Jv5utbqixrhyIgMtdl3c9wN184KGT6ybVV 2Ifv5BLCX1Imm6h0JNwd/EzHq6B/Q8c6MK0jTP0qUzzDFFigprmXFJsPwBty9CJS 9hMSNiTzeXQXzPoIuAZxYvY2/9jT2uVsBcUDJi64tgJKAmqUNd/0n/IBDs4aXDl6 kRPdOpTo7amQ1liAcft25upaxfAz7PIGf7cU45bD6trxYtyNDD2OIa998YjMsEGG BHvxVyCEoSV5QxhgbNC4wE6bZdIcuCNGsjmLyGeUMOh66IxAT/dN7aZuxLQJ6gJ5 JTIXLDxFfEseEIm25UWp2psBqHr2rPMMVSVWle3EXtTNfoTSiR2RQuamLKW2/f46 OffsjvPnFLrcs/vZwAGJci0rkUmlG3vXjrtTXujwto8d6ewQMaEVyNh3OSOpfR8n +WU9Z5YFZ9nYZUKNzmgAC+BGFIoy8KfcLdtdVvGfZlK4BHlK/vKgFKVeGWX5ufFU 6LgXxaLazY+2/7uEPP2DXHCHp+ZzQWOZEBB4nvwSOX1QQOk/spQ=Pf+6
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)