[apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor
Didier 'OdyX' Raboud
odyx at debian.org
Sat Jan 18 13:45:05 UTC 2014
Le vendredi, 17 janvier 2014, 11.26:59 Didier '' Raboud a écrit :
> Then the trigger can reload only the concerned profiles, and never do
> it for all of them. (Using the dpkg hashsums instead of timestamps
> would allow doing it only for _changed_ profiles too.)
> I'll try implementing something along those lines this week-end.
Okay. I went and tried, which helped me understand deb-triggers quite
better. Here it goes:
- "interest /etc/apparmor.d/" in apparmor make apparmor.postinst run
with "triggered …" if any package unpacks a file in /etc/apparmor.d.
- "activate /etc/apparmor.d" in any other package (given the above in
apparmor) let apparmor.postinst run with "triggered …" even if the
package doesn't unpack a file in said directory.
- BUT in a dpkg/apt run, all package triggers run after all package
This means that even if apparmor could have a trigger, it would only run
_after_ all triggering packages' configuration runs; including daemon
So, despite my initial thoughts, replacing dh_apparmor with a dpkg-
trigger is currently not possible, because (or thanks) of the dpkg
I'm therefore closing this bug, as the (my) initial request) can't be
More information about the AppArmor