Activity log for bug #1561762

Date Who What changed Old value New value Message
2016-03-24 22:45:01 Tyler Hicks bug added bug
2016-03-24 22:48:03 Tyler Hicks apparmor (Ubuntu): importance High Critical
2016-03-24 22:48:05 Tyler Hicks apparmor (Ubuntu): assignee Tyler Hicks (tyhicks)
2016-03-24 22:48:15 Tyler Hicks apparmor (Ubuntu): status New In Progress
2016-03-29 01:44:49 Tyler Hicks description The upstream AppArmor project has cut the 2.11 Beta 1 release. It contains a large number of bug fixes and a key feature. The feature is to allow profiles and applications to take advantage of the policy namespace stacking that has landed in the Xenial kernel. This will allow LXD containers to be confined with an over-arching AppArmor profile while individual processes inside the container can be further confined with an individual profile. Here's the changelog, containing Debian/Ubuntu bug fixes, that I have accumulated so far: apparmor (2.10.95-0ubuntu1~tyhicks2) xenial; urgency=medium * Update to apparmor 2.10.95 (2.11 Beta 1) - Allow Apache prefork profile to chown(2) files (LP: #1210514) - Allow deluge-gtk and deluge-console to handle torrents opened in browsers (LP: #1501913) - Allow file accesses needed by some programs using libnl-3-200 (Closes: #810888) - Allow file accesses needed on systems that use NetworkManager without resolvconf (Closes: #813835) - Adjust aa-status(8) to work without python3-apparmor (LP: #1480492) - Fix aa-logprof(8) crash when operating on files containing multiple profiles with certain rules (LP: #1528139) - Fix log parsing crashes, in the Python utilities, caused by certain file related events (LP: #1525119, LP: #1540562) - Fix log parsing crasher, in the Python utilities, caused by certain change_hat events (LP: #1523297) - Improve Python 2 support of the utils by fixing an aa-logprof(8) crasher when Python 3 is not available (LP: #1513880) - Send aa-easyprof(8) error messages to stderr instead of stdout (LP: #1521400) - Fix aa-autodep(8) failure when the shebang line of a script contained parameters (LP: #1505775) - Don't depend on the system logprof.conf when running utils/ build tests (LP: #1393979) - Fix apparmor_parser(8) bugs when parsing profiles that use policy namespaces in the profile declaration or profile transition targets (LP: #1540666, LP: #1544387) - Regression fix for apparmor_parser(8) bug that resulted in the --namespace-string commandline option being ignored causing profiles to be loaded into the root policy namespace (LP: #1526085) - Fix crasher regression in apparmor_parser(8) when the parser was asked to process a directory (LP: #1534405) - Fix bug in apparmor_parser(8) to honor the specified bind flags remount rules (LP: #1272028) - Support tarball generation for Coverity scans and fix a number of issues discovered by Coverity - Fix regression test failures on s390x systems (LP: #1531325) - Adjust expected errno values in changeprofile regression test (LP: #1559705) - The Python utils gained support for ptrace and signal rules - aa-exec(8) received a rewrite in C - apparmor_parser(8) gained support for stacking multiple profiles, as supported by the Xenial kernel (LP: #1379535) - libapparmor gained new public interfaces, aa_stack_profile(2) and aa_stack_onexec(2), allowing applications to utilize the new kernel stacking support (LP: #1379535) * Drop the following patches since they've been incorporated upstream: - aa-status-dont_require_python3-apparmor.patch - r3209-dnsmasq-allow-dash - r3227-locale-indep-capabilities-sorting.patch - r3277-update-python-abstraction.patch - r3366-networkd.patch, - tests-fix_sysctl_test.patch - parser-fix-cache-file-mtime-regression.patch - parser-verify-cache-file-mtime.patch - parser-run-caching-tests-without-apparmorfs.patch - parser-do-cleanup-when-test-was-skipped.patch - parser-allow-unspec-in-network-rules.patch * debian/rules, debian/apparmor.install, debian/apparmor.manpages: Update for new upstream binutils directory and the new aa-exec and aa-enabled binaries * debian/libapparmor-dev.manpages: Include the new aa_stack_profile.2 man page * debian/patches/r3424-nscd-profile-allow-paranoia-mode.patch: Allow file access needed for nscd's paranoia mode * debian/patches/r3425-adjust-stacking-tests-version-check.patch: Adjust the regression test build time checks, for libapparmor stacking support, to look for the 2.10.95 versioning rather than 2.11 -- Tyler Hicks <tyhicks@canonical.com> Thu, 24 Mar 2016 12:12:11 -0500 The upstream AppArmor project has cut the 2.11 Beta 1 release. It contains a large number of bug fixes and a key feature. The feature is to allow profiles and applications to take advantage of the policy namespace stacking that has landed in the Xenial kernel. This will allow LXD containers to be confined with an over-arching AppArmor profile while individual processes inside the container can be further confined with an individual profile. Here's the changelog, containing Debian/Ubuntu bug fixes, that I have accumulated: apparmor (2.10.95-0ubuntu1) xenial; urgency=medium * Update to apparmor 2.10.95 (2.11 Beta 1) (LP: #1561762) - Allow Apache prefork profile to chown(2) files (LP: #1210514) - Allow deluge-gtk and deluge-console to handle torrents opened in browsers (LP: #1501913) - Allow file accesses needed by some programs using libnl-3-200 (Closes: #810888) - Allow file accesses needed on systems that use NetworkManager without resolvconf (Closes: #813835) - Adjust aa-status(8) to work without python3-apparmor (LP: #1480492) - Fix aa-logprof(8) crash when operating on files containing multiple profiles with certain rules (LP: #1528139) - Fix log parsing crashes, in the Python utilities, caused by certain file related events (LP: #1525119, LP: #1540562) - Fix log parsing crasher, in the Python utilities, caused by certain change_hat events (LP: #1523297) - Improve Python 2 support of the utils by fixing an aa-logprof(8) crasher when Python 3 is not available (LP: #1513880) - Send aa-easyprof(8) error messages to stderr instead of stdout (LP: #1521400) - Fix aa-autodep(8) failure when the shebang line of a script contained parameters (LP: #1505775) - Don't depend on the system logprof.conf when running utils/ build tests (LP: #1393979) - Fix apparmor_parser(8) bugs when parsing profiles that use policy namespaces in the profile declaration or profile transition targets (LP: #1540666, LP: #1544387) - Regression fix for apparmor_parser(8) bug that resulted in the --namespace-string commandline option being ignored causing profiles to be loaded into the root policy namespace (LP: #1526085) - Fix crasher regression in apparmor_parser(8) when the parser was asked to process a directory (LP: #1534405) - Fix bug in apparmor_parser(8) to honor the specified bind flags remount rules (LP: #1272028) - Support tarball generation for Coverity scans and fix a number of issues discovered by Coverity - Fix regression test failures on s390x systems (LP: #1531325) - Adjust expected errno values in changeprofile regression test (LP: #1559705) - The Python utils gained support for ptrace and signal rules - aa-exec(8) received a rewrite in C - apparmor_parser(8) gained support for stacking multiple profiles, as supported by the Xenial kernel (LP: #1379535) - libapparmor gained new public interfaces, aa_stack_profile(2) and aa_stack_onexec(2), allowing applications to utilize the new kernel stacking support (LP: #1379535) * Drop the following patches since they've been incorporated upstream: - aa-status-dont_require_python3-apparmor.patch - r3209-dnsmasq-allow-dash - r3227-locale-indep-capabilities-sorting.patch - r3277-update-python-abstraction.patch - r3366-networkd.patch, - tests-fix_sysctl_test.patch - parser-fix-cache-file-mtime-regression.patch - parser-verify-cache-file-mtime.patch - parser-run-caching-tests-without-apparmorfs.patch - parser-do-cleanup-when-test-was-skipped.patch - parser-allow-unspec-in-network-rules.patch * debian/rules, debian/apparmor.install, debian/apparmor.manpages: Update for new upstream binutils directory and aa-enabled binary - Continue installing aa-exec into /usr/sbin/ for now since click-apparmor's aa-exec-click autopkgtest expects it to be there * debian/libapparmor-dev.manpages: Include the new aa_stack_profile.2 man page * debian/patches/r3424-nscd-profile-allow-paranoia-mode.patch: Allow file access needed for nscd's paranoia mode * debian/patches/r3425-adjust-stacking-tests-version-check.patch: Adjust the regression test build time checks, for libapparmor stacking support, to look for the 2.10.95 versioning rather than 2.11 * debian/patches/r3426-allow-debugedit-to-work-on-apparmor-parser.patch: Remove extra slash in the parser Makefile so that debugedit(8) can work on apparmor_parser(8) (LP: #1561939) * debian/patches/allow-stacking-tests-to-use-system.patch: Adjust the file rules of the new stacking tests so that the generated profiles allow the system binaries and libraries to be tested -- Tyler Hicks <tyhicks@canonical.com> Mon, 28 Mar 2016 20:26:48 -0500
2016-03-29 01:45:49 Tyler Hicks attachment added changelog.diff https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1561762/+attachment/4615442/+files/changelog.diff
2016-03-29 01:56:28 Tyler Hicks attachment added apparmor_2.10.95-0ubuntu1_amd64.build https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1561762/+attachment/4615459/+files/apparmor_2.10.95-0ubuntu1_amd64.build
2016-03-29 02:01:19 Tyler Hicks attachment added install.log https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1561762/+attachment/4615460/+files/install.log
2016-03-29 02:07:47 Tyler Hicks bug added subscriber Ubuntu Release Team
2016-03-29 02:07:53 Tyler Hicks apparmor (Ubuntu): status In Progress New
2016-03-29 02:07:55 Tyler Hicks apparmor (Ubuntu): assignee Tyler Hicks (tyhicks)
2016-03-29 02:23:34 Tyler Hicks bug added subscriber Ubuntu Security Team
2016-04-09 00:15:35 Steve Langasek apparmor (Ubuntu): status New Triaged
2016-04-09 07:09:05 Tyler Hicks apparmor (Ubuntu): status Triaged In Progress
2016-04-09 07:09:08 Tyler Hicks apparmor (Ubuntu): assignee Tyler Hicks (tyhicks)
2016-04-11 06:14:29 Launchpad Janitor apparmor (Ubuntu): status In Progress Fix Released