1

We installed a Nagios plugin that brought along build-essential, and I'd like to remove it because I don't want build tools on a production server.

When I simulate the apt-get remove command:

apt-get remove build-essential --simulate

It says it will also remove the Nagios plugin.

How can I remove build-essential while keeping the plugin?

Improve this question
3
  • What is the nature of the Nagios plugin? Does it compile source code regularly? It sounds like the plugin writer added a requirement/dependency. The APT command should have flags for removing packages that have dependencies.
    – 0xSheepdog
    May 2, 2014 at 0:26
  • look at this thread and see if the answers offer any assistance. askubuntu.com/questions/17745/…
    – 0xSheepdog
    May 2, 2014 at 0:29
  • It would be easier to answer this if you said which nagios plugin you are referring to (and where you got it, if not from Ubuntu's repositories).
    – thomasrutter
    May 2, 2014 at 1:21

1 Answer 1

Reset to default
2

The "nagios plugin" you installed probably lists build-essential as a dependency.

The most common reason a package would list build-essential as a dependency is if that package compiles some source code as part of its installation procedure. Depending on build-essential is not common practice for packages provided by Ubuntu itself, which on the rare occasions they do require some compilation during install, would not include all of build-essential.

Assuming it's listed as a "requires" dependency there is no way to remove the dependency but leave the package that depends on it using APT. This is a constraint that is enforced by APT for the entire time the package is installed.

In theory if the build tools were only required when the package was installed but are no longer being used, you could forcibly remove the various files belonging to build-essential and things would probably continue to work. But this is definitely not recommended as it will leave you with a system that, as far as APT/dpkg are concerned, is broken!

You say that you don't want build tools on a production server. Is this for security reasons? Because if so, simply not having particular tools available does not really enforce security. For one, build tools don't give ordinary users any extra privileges - they're still restricted to the same parts of the filesystem they would be anyway. They couldn't, for example, install code to run as superuser. Also, regardless of what's installed system-wide a user could still install and run binary tools (such as compilers) inside his or her own home directories with their user privileges.

Improve this answer
5
  • some compliance frameworks are sticklers for removing compilers and build tools from production systems. I agree with you that it is a nominal return on investment, security wise; unfortunately, a lot of "compliance" mechanisms are easier to just comply with, rather than try to mitigate with 'logic' and 'common sense'.
    – 0xSheepdog
    May 2, 2014 at 1:36
  • Yes. The alternative is to remove the offending nagios plugin, really - if not having build-essential is considered a mandatory requirement. Not knowing anything about the nagios plugin, maybe it's available from other sources which package it differently?
    – thomasrutter
    May 2, 2014 at 1:40
  • 1
    No properly packaged source should depend on build-essential as it's in essence a meta-package in Ubuntu. They can have it as a recommend if desiring the deps of build-essential to be installed. I'd look for a better packaged version of that plugin
    – doug
    May 2, 2014 at 2:00
  • Good point. I'll edit my answer a little.
    – thomasrutter
    May 2, 2014 at 2:20
  • Ok, thanks everyone. I was basically wondering if there was some option where apt would let you remove a dependency, and you've answered that.
    – Alan
    May 2, 2014 at 16:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .