The preinst isn't generated by dh_apparmor. The logic for the "disable" directory is part of the sssd preinst, likely copied from https://wiki.ubuntu.com/ApparmorProfileMigration The examples there didn't include the removal of the directory, so I've updated the wiki to include it now, thanks for catching that! -Kees -- Kees Cook @debian.org