Subject: Re: bug#881: invoke-rc.d: Policy layer may override runlevel constraint

From: Mark Hindley <[email-masked]>
Date: Sun, 6 Apr 2025 09:37:14 +0100

Opty,

Thanks,

On Thu, Apr 03, 2025 at 01:16:40PM +0200, Opty wrote:
> > That isn't conventional Debian practice.
> 
> I could continue using the policy layer unmodified, selectively allow
> what I need (extra work) and keep denied the rest
> 
> -or-
> 
> modify invoke-rc.d or rather policy-rc.d to check
> $DPKG_MAINTSCRIPT_NAME (to detect preinst, postinst, prerm or postrm
> script), crosscheck $DPKG_MAINTSCRIPT_PACKAGE vs. $INITSCRIPTID
> (substring of each other) to allow calling other scripts and
> eventually do nothing, maybe ask the administrator.
> 
> Both seem unintentional error- or side-effect-prone.
> 
> I could also just modify invoke-rc.d to skip the querypolicy call in
> case of K link.

I find it hard to see an actionable bug here. I think invoke-rc.d and
policy-rcd-declarative* are behaving as advertised. Your requirements appear
different to what policy-rcd-declarative-deny-all provides. So, as Simon
suggested, you need to write your own policy script to meet your requirements.

Therefore I will close this.

If you think I have missed something, please feel free to reopen.

Thanks

Mark