What happened to the complain flag?

[curiosityseeker]

aa-status shows that, e.g., kwin_wayland is running in the complain mode. And indeed, the profile on my system has

profile kwin_wayland /{,usr/}{,s}bin/kwin_wayland flags=(attach_disconnected,mediate_deleted,complain)

However, looking it up here the complain flag is missing. Only in https://github.com/roddhjav/apparmor.d/blob/main/dists/flags/main.flags the complete list of flags is shown. This seems to be the case for all profiles with the complain flag.

What have I missed? Why is the complain flag no longer displayed in the "original" profile?

[roddhjav]

Flags for all unstable profiles are set during the build process using config from main.flags. It works this way as it is easier edit/manage a single file than 2000 profile files.

See https://apparmor.pujol.io/development/workflow/#profile-flags

[curiosityseeker]

Thanks, I was aware of that (the workflow page was new to me, though). However, what irritated me was that previously in PRs for new profiles the complain flag had to be added to main.flags and the profile itself (unless I'm completely off track). The latter seems to be no longer the case and I might have missed if and when this change was communicated.

I'd like to add that some users might be confused (like I was) when looking at a profile that that flag is not displayed there as they expect from profiles found elsewhere.

[beroal]

I'd like to add that some users might be confused (like I was) when looking at a profile that that flag is not displayed there as they expect from profiles found elsewhere.

The installation process changes profiles in other ways too, so users will be confused anyway. Perhaps, a page listing all transformations in one place is needed.

[roddhjav]

This is the opposite. The idea is to only have the complain flag defined in the manifest, never in the profile. They are some (historical) exception and I don't enforce it from contributor. Hence the confusion.

I do agree, I need to add a page to the documentation that list of changes applied to the profile when running make (even if most people won't read it anyway...)

[curiosityseeker]

The installation process changes profiles in other ways too, so users will be confused anyway.

Yes, and while I understand why this is done in order to manage that many profiles, it's pretty much the opposite of a WYSIWYG approach. 😉 Let's hope that this will not negatively affect the adaption by new users. I also wonder if using directives doesn't make upstreaming profiles more difficult.