app profile rules cannot be deleted once app package has been removed from system

[Brewster Malevich]

Binary package hint: ufw

On Ubuntu Server 9.04 (I suppose this would apply to any Ubuntu install up to 9.04, but have not tested this):

(0) enable ufw
(1) install (for example) package 'samba' and all of its dependencies.
(2) run command: sudo ufw allow Samba
(3) uninstall samba packages

The result is that the app rule added to ufw cannot be deleted or modified through the command line.

Solution: Install 'samba' packages again, delete the app rule from ufw, and ~then~ remove the package 'samba'.

This seems a bit flawed, perhaps we could have some way to remove ufw rules after a package has been removed...? I think we may be taking too much liberty by making an 'app rule deletion' automatic.

[Andreas Olsson (andol)]

I can confirm this problem in Karmic and ufw 0.27.1-2.

Perhaps having application profiles in use being copied to a special cache directory might be a solution.

[Jamie Strandboge (jdstrand)]

Thank you for using Ubuntu and taking the time to report a bug. I can confirm this. I think removing the rule automatically is the wrong way to go. For example, someone has apache2 installed and uses the app rule. Then, at some later point installs boa, which uninstalls apache but does not supply an app profile. Removing the rule automatically would break this setup.

The best thing is to simply allow the removal of the rule even if the profile doesn't exist. I think it worked this way in intrepid (I need to check) and regressed in a later version.

[Jamie Strandboge (jdstrand)]

This was introduced when fixing bug #263757. I'll fix this for Karmic and 0.29. 9.04 users can work around this by editing /var/lib/user*.rules by hand and deleting the stanza (ie the tuplet and corresponding rules) for the deleted app rule, then reload the firewall.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ufw - 0.29-0ubuntu1

---------------
ufw (0.29-0ubuntu1) karmic; urgency=low

  * new upstream release:
    - adds egress filtering support (LP: #382932)
    - new translations
    - new man page: ufw-framework.8
    - new check-requirements to help debug systems with custom kernels
    - fixes deletion of non-existent application rules (LP: #407810)
  * Debconf translation updates:
    - Galician (thanks to Marce Villarino. closes: #538383)
    - Japanese (thanks to Hideki Yamane. closes: #539595)
    - Italian (thanks to Luca Monducci. closes: #540204)
    - Portuguese (thanks to Américo Monteiro. closes: #538908)
    - Basque (thanks to Piarres Beobide. closes: #539077)
    - Czech (thanks to Michal Simunek)
    - Slovak (thanks to Ivan Masár. closes: #534450)
    - Swedish (thanks to Martin Bagge. closes: #538336)
    - verify/update the above to fix typo in template (closes: #534231)
  * debian/rules: install tests/check-requirements into /usr/share/ufw
  * update ucf md5sums for before.rules and before6.rules
  * remove no longer used lintian override
  * debian/dirs: remove unused /var/lib/ufw

 -- Jamie Strandboge <email address hidden> Tue, 25 Aug 2009 09:12:26 -0500

[Jamie Strandboge (jdstrand)]

Fixed in 0.29