removing docker snap leaves apparmor misconfigured

[Robert Collins]

I removed the docker snap after the showstopper bug with its private /tmp; after that I installed docker via apt but runc was getting apparmor denying signal delivery; this was due to stale snap docker profiles; cleaning those up solved it but they should have been cleaned up by removing the snap in the first place.

sudo aa-remove-unknown
Removing 'docker-default'
Removing 'snap-update-ns.docker'
Removing 'snap.docker.compose'
Removing 'snap.docker.docker'
Removing 'snap.docker.dockerd'
Removing 'snap.docker.help'
Removing 'snap.docker.hook.install'
Removing 'snap.docker.hook.post-refresh'
Removing 'snap.docker.machine'

[Zygmunt Krynicki (zyga)]

There are two separate issues here:

 - removing snap.* apparmor profiles
 - removing docker apparmor profile

For the second issue, it is a bug in the snap, it should be handling that in its pre-remove hook. I will report this internally

For the first issue, it's a hard problem. We remove the profiles from disk but we cannot remove them from the kernel easily without removing confinement from running processes. There is ongoing work to track processes better and perform cleanup on cgroup becoming empty but it is not close to release yet.