debathena-apparmor-config 1.2~ubuntu10.10 fails to install

[zev]

After trying to install debathena-apparmor-config (1.2~ubuntu10.10), I get the following:

After this operation, 0B of additional disk space will be used.
Setting up debathena-apparmor-config (1.2~ubuntu10.10) ...
 * Reloading AppArmor profiles
Skipping profile in /etc/apparmor.d/disable: usr.bin.firefox
AppArmor parser error for /etc/apparmor.d/usr.sbin.cupsd.debathena in /etc/apparmor.d/usr.sbin.cupsd.debathena at line 133: Could not open 'local/usr.sbin.cupsd'
AppArmor parser error for /etc/apparmor.d/usr.sbin.ntpd.debathena in /etc/apparmor.d/usr.sbin.ntpd.debathena at line 65: Could not open 'local/usr.sbin.ntpd'
                                                                                                                      [fail]
invoke-rc.d: initscript apparmor, action "reload" failed.
dpkg: error processing debathena-apparmor-config (--configure):
 subprocess installed post-installation script returned error exit status 123
Errors were encountered while processing:
 debathena-apparmor-config
E: Sub-process /usr/bin/dpkg returned an error code (1)

Touching /etc/apparmor.d/local/usr.sbin.cupsd and /etc/apparmor.d/local/usr.sbin.ntpd allows the installation to complete

[geofft]

Interesting, and that solution is fine -- those files are supposed to be there but just contain comments. Are there any other files in /etc/apparmor.d/local/*?

What versions of the cups and ntp packages do you have? (More relevantly, do /var/lib/dpkg/info/{cups,ntp}.postinst say something about creating the local/* files?)

Is this a 32- or 64-bit machine?

[jdreed]

For completeness, see also  RT:1379306

[zev]

zev@cliffjumper:~$ ls /etc/apparmor.d/local
README  sbin.dhclient3  usr.bin.evince  usr.bin.firefox  usr.sbin.cupsd  usr.sbin.ntpd  usr.sbin.tcpdump

cups 1.4.4-6ubuntu2.1
ntp 1:4.2.4p8+dfsg-1ubuntu6

Both postinst files appear to create the local/* files if /etc/apparmor.d/usr.bin.{ntp,cups} already exist and the local ones do not.

64-bit.

[zev]

I also uploaded my cups.postinst and ntp.postinst for convenience.

[jdreed]

This only affects certain minimal Ubuntu installs. However, a monolithic apparmor-config is the wrong answer and we should return to apparmor-config on a per-package basis (but should attempt to refactor the common code in a clever way).

[jdreed]

I managed to get this with the Ubuntu alternate CD using VMWare's "Easy Install".

[jdreed]

Fixed in r25174. We should still move away from a monolithic apparmor config, but that's a separate ticket.

[geofft]

r25174 will cause the postinst to fail on systems that don't have /etc/apparmor.d/local already; see  25704.

Does "Easy Install" give you a tasksel prompt? I suspect that for basically all reasonable install methods including PXE, if you check the "Ubuntu Desktop" task, you'll get both cupsd and ntpd installed before you get around to installing Debathena.

[jdreed]

Replying to geofft:

r25174 will cause the postinst to fail on systems that don't have /etc/apparmor.d/local already; see  25704.

Committed r25184 to fix this.

Does "Easy Install" give you a tasksel prompt? I suspect that for basically all reasonable install methods including PXE, if you check the "Ubuntu Desktop" task, you'll get both cupsd and ntpd installed before you get around to installing Debathena.

No, like all VMWare "Easy Installs", the point is to have it entirely unattended. I do not get to interact with the target OS until the installation has completed. Note the key here is the Alternate CD. An Easy Install with Desktop will DTRT, I think.

[geofft]

After further revision we settled on r25186. I tried several stress tests, enough to trigger what I'm going to assume is a latent, unrelated config-package-dev bug when uninstalling apparmor-config, and it works fine (this chroot has both lucid and natty in sources.list and I tried installing apparmor, debathena-apparmor-config, and ntp from both in various orders). ACK to push to production, assuming Jon has also tested in the "Easy Install" reproduction recipe.

[jdreed]

This got built and pushed out, apparently.