Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1242546 > unrolled thread

Bug#1103503: isc-dhcp-client: In /etc/apparmor.d/local, sbin.dhclient should be renamed to usr.sbin.dhclient for consistency

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1103503: isc-dhcp-client: In /etc/apparmor.d/local, sbin.dhclient should be renamed to usr.sbin.dhclient for consistency Vincent Lefevre <vincent@vinc17.net> - 2025-04-18 11:20 +0200
    Bug#1103503: isc-dhcp-client: In /etc/apparmor.d/local, sbin.dhclient should be renamed to usr.sbin.dhclient for consistency Vincent Lefevre <vincent@vinc17.net> - 2025-04-18 11:40 +0200
    Bug#1103503: isc-dhcp-client: In /etc/apparmor.d/local, sbin.dhclient should be renamed to usr.sbin.dhclient for consistency Vincent Lefevre <vincent@vinc17.net> - 2025-04-22 13:10 +0200
    Bug#1103503: isc-dhcp-client: In /etc/apparmor.d/local, sbin.dhclient should be renamed to usr.sbin.dhclient for consistency Alexander Kurtz <alexander@kurtz.be> - 2025-05-03 20:40 +0200

#1242546 — Bug#1103503: isc-dhcp-client: In /etc/apparmor.d/local, sbin.dhclient should be renamed to usr.sbin.dhclient for consistency

Package: isc-dhcp-client
Version: 4.4.3-P1-7
Severity: wishlist

In /etc/apparmor.d, sbin.dhclient was renamed to usr.sbin.dhclient,
so I suppose that the same rename should be done in
/etc/apparmor.d/local (this is like that for the other files
in /etc/apparmor.d/local). And in /etc/apparmor.d/usr.sbin.dhclient,

  #include <local/sbin.dhclient>

should be changed to

  #include <local/usr.sbin.dhclient>

-- System Information:
Debian Release: trixie/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable-debug'), (500, 'proposed-updates-debug'), (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.22-amd64 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages isc-dhcp-client depends on:
ii  debianutils  5.22
ii  iproute2     6.14.0-3
ii  libc6        2.41-7

Versions of packages isc-dhcp-client recommends:
ii  isc-dhcp-common  4.4.3-P1-7

Versions of packages isc-dhcp-client suggests:
pn  avahi-autoipd         <none>
pn  isc-dhcp-client-ddns  <none>
pn  resolvconf            <none>

-- no debconf information

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)

[toc] | [next] | [standalone]

#1242551

Control: severity -1 serious

as this yields a broken configuration if the dhclient files had
been removed before the upgrade (seen on one of my machines).

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)

[toc] | [prev] | [next] | [standalone]

#1243121

Hi,

On 2025-04-22 11:52:24 +0200, intrigeri wrote:
> Vincent Lefevre (2025-04-19):
> > On 2025-04-18 13:40:01 +0200, intrigeri wrote:
> >> What dhclient files have been removed before the upgrade?
> >
> > /etc/apparmor.d/sbin.dhclient
> > /etc/apparmor.d/local/sbin.dhclient
> >
> >> How were they removed?
> >
> > With "rm".
> 
> OK, then FWIW I don't think severity serious is justified: you've
> manually deleted a file (/etc/apparmor.d/local/sbin.dhclient) created
> by maintainer scripts. I'm not the maintainer so this is just my
> personal opinion.

I disagree. It is the right of the user to remove configuration files,
as long as this is done in a consistent way. Packages must be able to
cope with that (re-adding the main file but not the associated local
one is not correct).

> >> Can you please describe how the resulting configuration is broken?
> >
> > After the upgrade, I just have
> >
> > cventin:~> ll /etc/apparmor.d/**/*dhclient*
> > -rw-r--r-- 1 root root 3590 2025-04-04 16:49:15 /etc/apparmor.d/usr.sbin.dhclient
> >
> > The one under /etc/apparmor.d/local is absent, though
> > /etc/apparmor.d/usr.sbin.dhclient does
> >
> >   #include <local/sbin.dhclient>
> 
> I think the maintainers will want to know what's the actual impact
> of this.
> 
> I suppose it makes apparmor.service fail to start?

No, I don't see any error with apparmor.service (and the documentation
does not suggest that there would be a fatal error for that).

> Anything else?

The apparmor.d(5) man page says:

  The  leading  '#'  is  optional,  and  the  '#include' keyword can be
  followed by an option conditional 'if exists' that specifies  profile
  compilation should continue if the specified file or directory is not
  found.

So, a missing file without "if exists" would stop the compilation of
the profile. I don't know what this implies in practice.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)

[toc] | [prev] | [next] | [standalone]

#1244625

[Multipart message — attachments visible in raw view] — view raw

Control: tags -1 - moreinfo + patch
Control: severity -1 serious
Justification: Causes the apparmor service to crash on fresh Trixie installations

Hi,

I think this issue is Severity: serious because if the isc-dhcp-client
is installed on a *fresh* Trixie installation, the
/etc/apparmor.d/local/sbin.dhclient file is never created but is still
referenced by the /etc/apparmor.d/usr.sbin.dhclient file, which causes
the apparmor service to crash. This MR should hopefully fix it:

https://salsa.debian.org/debian/isc-dhcp/-/merge_requests/16

I have tested this in a fresh VM for both upgrades and fresh
installations and everything seems to work as expected.

Best regards

Alexander Kurtz

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web