Ubuntu
apparmor package

Update apparmor python utils to 2.9.2 version in trusty

Bug #1449769 reported by Steve Beattie
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
apparmor (Ubuntu)
Fix Released
High
Steve Beattie

Bug Description

[impact]

Leading up to the release of 14.04, we decided to pull in a pre-release
version of the python utils, because we did not want to continue
supporting the out of date perl tools for the 5 years of the 14.04
release support lifetime. There were a number of issues with the
python tools that prevent users from using them effectively that
have subsequently been addressed by upstream releases, as well as
the addition of a significant number of tests.

Specific bugs that should be addressed by this include:
bug 1294797: aa-genprof traceback with apparmor 2.8.95
bug 1319829: aa-genprof will crash when selecting scan
bug 1317176: aa-logprof attempts to read program binary instead of profile
bug 1324154: aa-logprof is trying to process a binary instead of the profile
bug 1310598: AppArmor python tools fail to parse mounts with UTF-8 non-ascii characters
bug 1378095: aa-complain traceback when marking multiple profiles

[steps to reproduce]

1) attempt to use the aa-genprof/aa-logprof to generate or update policy

[regression potential]

It's possible that the simple management tools, aa-enforce,
aa-complain, and aa-disable could be broken by this
large update. However, the test-apparmor.py script from
lp:qa-regression-testing attempts to exercise those scripts
to ensure they still function. Regressions could be introduced
in aa-genprof and aa-logprof, but they would need to be pretty
substantial to outweigh the improvement in quality that the 2.9.2
tools represent. Furthermore, a number of testcases have been added
(and again are driven by lp:qa-regression-testing) to try to prevent
the introduction of regressions.

See original description
Tyler Hicks (tyhicks)
Changed in apparmor (Ubuntu):
status: New → In Progress
assignee: nobody → Steve Beattie (sbeattie)
importance: Undecided → High
Revision history for this message
Steve Beattie (sbeattie) wrote :

This will have been addressed in wily in apparmor 2.9.2-0ubuntu1. Attached is the (large) patch to update the python utils in trusty to the 2.9.2 version as part of an SRU.

description: updated
Revision history for this message
Steve Beattie (sbeattie) wrote :

Here is the full debdiff for the trusty SRU, incorporating this fix and several others.

Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "utils-update_to_2.9.2.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

tags: added: patch
Steve Beattie (sbeattie)
description: updated
Revision history for this message
Steve Beattie (sbeattie) wrote :

I have gone through and verified each of the individual linked bug reports are fixed in the version of apparmor-utils/python3-apparmor in trusty-proposed. I've also gone through and ran the lp:qa-regression-testing test-apparmor.py script against the version in trusty-proposed on both i386 and amd64 and with 3.13, 3.16 and 3.19 kernels, and did not see any test failures. Also, while going through and verifying the bug reports, I did not see any regressions in behavior and note that the behavior of the tools is significantly improved. Based on this, I'm marking verification-done for this bug report.

tags: added: verification-done
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apparmor - 2.8.95~2430-0ubuntu5.2

---------------
apparmor (2.8.95~2430-0ubuntu5.2) trusty-proposed; urgency=medium

  * debian/patches/php5-Zend_semaphore-lp1401084.patch: allow php5
    abstraction access to Zend opcache files (LP: #1401084)
  * debian/patches/dnsmasq-lxc_networking-lp1403468.patch: update
    profile for lxc support (LP: #1403468)
  * debian/patches/profiles-texlive_font_generation-lp1010909.patch:
    allow generation of texlive fonts by sanitized-helpers
    (LP: #1010909)
  * debian/apport/source_apparmor.py: fix the apparmor apport hook
    so it does not raise an exception if a non-unicode character is
    found in /var/log/kern.log or in /var/log/syslog. This should
    work under python3 or python2.7 (LP: #1304447)
  * debian/patches/profiles-dovecot-updates-lp1296667.patch: update
    dovecot profiles to address several missing permissions.
    (LP: #1296667)
  * debian/patches/profiles-adjust_X_for_lightdm-lp1339727.patch:
    adjust X abstraction for LightDM xauthority location (LP: #1339727)
  * debian/patches/libapparmor-fix_memory_leaks-lp1340927.patch; fix
    memory leaks in log parsing component of libapparmor (LP: #1340927)
  * debian/patches/libapparmor-another_audit_format-lp1399027.patch:
    add support for another log format style (LP: #1399027)
  * debian/patches/tests-workaround_for_unix_socket_change-lp1425398.patch:
    work around apparmor kernel behavioral change in regression tests
    (LP: #1425398)
  * debian/control: add breaks on python3-apparmor against older
    apparmor-utils that used to be where python bits lived
    (LP: #1373259)
  * debian/patches/utils-update_to_2.9.2.patch: update the python
    utilities to the upstream 2.9.2 (LP: #1449769, incorporating a
    large number of fixes and improvements, including:
    - fix aa-genprof traceback with apparmor 2.8.95 (LP: #1294797)
    - fix aa-genprof crashing when selecting scan on Ubuntu 14.04 server
      (LP: #1319829)
    - make aa-logprof read profile instead of program binary
      (LP: #1317176, LP: #1324154)
    - aa-complain: don't traceback when marking multiple profiles
      (LP: #1378095)
    - make python tools able to parse mounts with UTF-8 non-ascii
      characters (LP: #1310598)

 -- Steve Beattie <email address hidden> Thu, 30 Apr 2015 12:18:08 -0700

Changed in apparmor (Ubuntu):
status: In Progress → Fix Released
Revision history for this message
Adam Conrad (adconrad) wrote : Update Released

The verification of the Stable Release Update for apparmor has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.