Vincas Dargis:
> We have to have in mind that, *for example*, Thunderbird is shipping
> it's profile even on Debian Jessie, and if we update `tunables/global`
> *and* all `apparmor-profiles` to use `@{sys}`, and in the meantime if
> oldstable will not get `tunables/global` update, Thunderbird maintainers
> will have extra work to maintain two (with/without @{sys}) profiles.
Right, let's avoid proceeding in a backwards-incompatible way.
One solution could be:
1. in every profile that hard-codes /sys, switch to @{sys} and explicitly include tunables/sys
2. include tunables/sys in tunables/global
3. wait until there's no supported distro left that lacks (2)
4. drop "explicitly include tunables/sys" from all profiles
Vincas Dargis:
> We have to have in mind that, *for example*, Thunderbird is shipping
> it's profile even on Debian Jessie, and if we update `tunables/global`
> *and* all `apparmor-profiles` to use `@{sys}`, and in the meantime if
> oldstable will not get `tunables/global` update, Thunderbird maintainers
> will have extra work to maintain two (with/without @{sys}) profiles.
Right, let's avoid proceeding in a backwards- incompatible way.
One solution could be:
1. in every profile that hard-codes /sys, switch to @{sys} and explicitly include tunables/sys
2. include tunables/sys in tunables/global
3. wait until there's no supported distro left that lacks (2)
4. drop "explicitly include tunables/sys" from all profiles