From 4177f93e55bf56e490273d3de6c830901592054a Mon Sep 17 00:00:00 2001 From: Christoph Weiss Date: Tue, 4 Feb 2025 17:42:14 +0100 Subject: [PATCH] Only update AppArmor profile if not chroot'ed This prevents `postinst` script failure when run in a `chroot` environment. This closes #8841. --- packages/app-builder-lib/templates/linux/after-install.tpl | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/packages/app-builder-lib/templates/linux/after-install.tpl b/packages/app-builder-lib/templates/linux/after-install.tpl index 7433249abf7..2155570ebb0 100644 --- a/packages/app-builder-lib/templates/linux/after-install.tpl +++ b/packages/app-builder-lib/templates/linux/after-install.tpl @@ -42,7 +42,10 @@ if test -d "/etc/apparmor.d"; then if apparmor_parser --skip-kernel-load --debug "$APPARMOR_PROFILE_SOURCE" > /dev/null 2>&1; then cp -f "$APPARMOR_PROFILE_SOURCE" "$APPARMOR_PROFILE_TARGET" - if hash apparmor_parser 2>/dev/null; then + # Updating the current AppArmor profile is not possible and probably not meaningful in a chroot'ed environment. + # Use cases are for example environments where images for clients are maintained. + # There, AppArmor might correctly be installed, but live updating makes no sense. + if ! { [ -x '/usr/bin/ischroot' ] && ischroot; } && hash apparmor_parser 2>/dev/null; then # Extra flags taken from dh_apparmor: # > By using '-W -T' we ensure that any abstraction updates are also pulled in. # https://wiki.debian.org/AppArmor/Contribute/FirstTimeProfileImport