💡 Summary

Remove the following when possible:

• apt-get purge of the firefox and passt packages
• systemctl reload of apparmor.service

Motivation and context

Purging firefox is currently necessary because the installation available on the GitHub runner instance provides two conflicting AppArmor profiles:

• /etc/apparmor.d/usr.bin.firefox
• /etc/apparmor.d/firefox
  This conflict causes the aa-disable /usr/sbin/unix_chkpwd command to fail.

Purging passt is currently necessary because the installation available on the GitHub runner instance contains a wonky AppArmor file (/etc/apparmor.d/abstractions/passt) that causes the aa-disable /usr/sbin/unix_chkpwd command to fail.

The systemctl reload of apparmor.service is required to force AppArmor to remove the corresponding profiles after the packages are purged. (AppArmor profiles count as configuration files in Debian-based distributions.)

Once newer versions of these packages without these limitations are available on the GitHub runners these apt-get purge commands and the systemctl reload apparmor.service command that follows can be safely removed.