debathena-kerberos-config makes Karmic’s cupsd crash on startup

[andersk]

anders@balanced-tree:~$ sudo /etc/init.d/cups start
 * Starting Common Unix Printing System: cupsd
cupsd: Child exited on signal 6!
                                                                         [fail]

==> syslog <==
Aug  3 04:09:30 balanced-tree cupsd: Libgcrypt error: reading `/proc/sys/crypto/fips_enabled' failed: Permission denied - abort

--- /etc/apparmor.d/usr.sbin.cupsd.debathena-orig	2009-07-11 12:38:05.000000000 -0400
+++ /etc/apparmor.d/usr.sbin.cupsd.debathena	2009-04-30 08:16:09.000000000 -0400
@@ -62,5 +62,4 @@
   @{PROC}/*/net/ r,
   @{PROC}/*/net/** r,
-  @{PROC}/sys/crypto/** r,
   /sys/** r,
   /usr/bin/* ixr,
@@ -118,4 +117,5 @@
   # Kerberos authentication
   /etc/krb5.conf r,
+  /etc/krb5.conf.debathena r,
   deny /etc/krb5.conf w,
   /etc/krb5.keytab rk,
@@ -141,7 +141,4 @@
   capability setuid,
 
-  # unfortunate, but required for when $HOME is 700
-  capability dac_override,
-
   /bin/dash ixr,
   /bin/bash ixr,

[broder]

Are you still using Jaunty packages? We generate that file with a DEB_TRANSFORM_FILES, so I don't know how that diff could be getting in there otherwise.

kerberos-config was one of the packages that did build on Karmic - you should try running the Karmic build instead.

[andersk]

   debathena / trac-#325 / broder  12:25  (Evan Broder)
       Oh Anders - did you see my reply about Karmic's kerberos-config?
   debathena / trac-#325 / andersk  12:25  (Anders Kaseorg)
       Oh.
   debathena / trac-#325 / broder  12:26  (Evan Broder)
       I didn't want to close the bug without hearing from you
   debathena / trac-#325 / andersk  12:29  (Anders Kaseorg)
       I am using Karmic packages, though.  I suspect something funny
       happened in the Jaunty → Karmic upgrade.
   debathena / trac-#325 / andersk  12:30  (Anders Kaseorg)
       Is there some reason I should have both
       /etc/apparmor.d/usr.sbin.cups.debathena and
       /etc/apparmor.d/usr.sbin.cupsd.debathena?
   debathena / trac-#325 / broder  12:32  (Evan Broder)
       I don't think you should have a usr.sbin.cupsd.debathena
   debathena / trac-#325 / andersk  12:32  (Anders Kaseorg)
       I have /etc/apparmor.d/usr.sbin.cupsd!
   debathena / trac-#325 / broder  12:32  (Evan Broder)
       Yeah, that should have been DEB_REMOVE_FILES'd
   debathena / trac-#325 / broder  12:32  (Evan Broder)
       I think this is a typo, and you should have a usr.sbin.cupsd.debathena
   debathena / trac-#325 / andersk  12:33  (Anders Kaseorg)
       I do have usr.sbin.cupsd.debathena, as well as usr.sbin.cups.debathena.
   debathena / trac-#325 / andersk  12:33  (Anders Kaseorg)
       Uninstalling debathena-kerberos-config left usr.sbin.cupsd.debathena
       and the diversion in place.
   debathena / trac-#325 / broder  12:33  (Evan Broder)
       Give me a second - I'm trying to dig into the package's history
   debathena / trac-#325 / broder  12:35  (Evan Broder)
       So yeah - it looks like geofft's 1.7.1 accidentally replaced
       usr.sbin.cupsd.debathena with usr.sbin.cups.debathena
   debathena / trac-#325 / andersk  12:36  (Anders Kaseorg)
       It also left the /etc/apparmor.d/abstractions/kerberosclient diversion
       in place.
   debathena / trac-#325 / broder  12:36  (Evan Broder)
       Yeah, I can see how our packaging wouldn't be clever enough to deal
       with that case
   debathena / trac-#325 / broder  12:37  (Evan Broder)
       I...think...that what we want to do is
       (a) add an "else" clause for both of the ifneqs in the debian/rules that
       DEB_UNREMOVE_FILES's the files
       (b) Fix the typo'd filename
       (c) Add logic to the postinst to remove usr.sbin.cups.debathena if it
       exists
   debathena / trac-#325 / broder  12:39  (Evan Broder)
       But I can't actually do that now, because I'm trying to pretend to
       actually do work right now. Can you update/refile your bug?

[broder]

This is a duplicate of #319