ospack: Switch AppArmor profiles to complain mode
After the rebase to Buster, some AppArmor profiles have become problematic and prevent the components from working.
In particular, the logind, Canterbury and Ribchester profiles prevent the Mildenhall HMI from appearing on the screen.
Until they get updated, switch them to complain mode rather than enforcing.
Merge request reports
Activity
4 4 {{- $suite := or .suite "v2019dev0" -}} 5 5 {{- $timestamp := or .timestamp "" -}} 6 6 {{- $ospack := or .ospack (printf "ospack_%s-%s-%s" $suite $architecture $type) -}} 7 {{- $ivitools := or .ivitools "enabled" -}} 
I'm not too enthusiastic about it either, but it provides a readily available toggle for product teams that will try to base their work on the sample recipes in !113 (merged).
Now, I'm not sure this is has the best naming, mechanism and approach, but since it is here, for consistency with other recipes it seemed appropriate to introduce it in the minimal recipe as well.
-
The reason
aa-complaintakes the difficult route is that theforce-complainsymlinks break the AppArmor cache.I don't think we're too concerned about that, this is a stop-gap in any case, so I will rework my patch to use the symlinks approach.
changed this line in version 5 of the diff
1 #!/usr/bin/env python3 -
Because I looked at what
aa-complaindoes and I didn't stumble on anyone documenting theforce-complainsymlinks, so now I'm mad at AppArmor. Well, not really, luckily this is less than a hour of trivial copying and pasting, so I'm more than happy to rework this one to use the symlinks. I really wonder whyaa-complaintook the long-winded approach though... changed this line in version 2 of the diff
added 1 commit
- 959c8ce9 - ospack: Switch AppArmor profiles to complain mode
added 1 commit
- d13c1b4c - ospack: Switch AppArmor profiles to complain mode
added 1 commit
- 7c71ec63 - ospack: Switch AppArmor profiles to complain mode
156 156 chroot: true 157 157 script: scripts/generate_locales.sh 158 158 159 - action: run 160 description: Switch the logind AppArmor profile to complain mode 161 chroot: false 162 script: scripts/apparmor-profile-switch-to-complain.sh ${ROOTDIR}/etc/apparmor.d/lib.systemd.systemd-logind 163 164 {{ if eq $ivitools "enabled" }} changed this line in version 6 of the diff
added 1 commit
- fffab36d - ospack: Switch AppArmor profiles to complain mode