AppArmor

lp:apparmor/2.11

Created by John Johansen on 2017-04-13 and last modified on 2017-10-27

Get this branch:: bzr branch lp:apparmor/2.11

Members of AppArmor Developers can upload to this branch. Log in for directions.

Branch merges

No branches dependent on this one.

Related bugs

Bug #1689667: garbage ptrace events

Undecided

New

Link a bug report

Related blueprints

Branch information

Owner:: AppArmor Developers

Project:: AppArmor

Status:: Mature

Recent revisions

3687. By Simon Déziel on 2017-10-27

profiles: update wireshark profile for modern releases

MErge from trunk commit 3728

Acked-by: Steve Beattie <email address hidden>

3686. By intrigeri on 2017-10-26

profiles: allow OpenAL HRTF support in audio abstraction

Merge from trunk commit 3726

The files are "head-related transfer function" data sets, used by
OpenAL for better spatialization of sounds when headphones are detected.

Acked-by: Steve Beattie <email address hidden>

Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874665

3685. By intrigeri on 2017-10-26

binutils: honor ${CFLAGS} and ${CPPFLAGS}

Merge from trunk revision 3723.

Acked-by: Steve Beattie <email address hidden>

3684. By Vincas Dargis on 2017-10-26

profiles: tunables/global - accept seven digit pids

[Merge from trunk revision 3722]

On 64bit systems, /proc/sys/kernel/pid_max can be set to PID_MAX_LIMIT,
(2^22), which results in seven digit pids. Adjust the @{PID} variable in
tunables/global to accept this.

Acked-by: intrigeri <email address hidden>
Acked-by: Steve Beattie <email address hidden>

Bug: https://bugs.launchpad.net/apparmor/+bug/1717714

3683. By Christian Boltz on 2017-10-23

Add python3.6 line to utils/logprof.conf

This is a backport of trunk r3718 by intrigeri

Acked-by: John Johansen <email address hidden> for 2.11 and 2.10 (on IRC)

3682. By Christian Boltz on 2017-10-20

Allow reading /etc/netconfig in abstractions/nameservice

/etc/netconfig is required by the tirpc library which nscd and several
other programs use.

References: https://bugzilla.opensuse.org/show_bug.cgi?id=1062244

Acked-by: Seth Arnold <email address hidden> for 2.9, 2.10, 2.11 and trunk

3681. By John Johansen on 2017-10-19

bump release version to 2.11.1

3680. By Steve Beattie on 2017-10-19

libapparmor: fix swig test_apparmor.py for zero length ptrace records
Merge from trunk revision 3715

The added testcase for a ptrace target with an empty string
(ptrace_garbage_lp1689667_1.in) was causing the swig python test script
to fail. The generated python swig record for libapparmor ends up
setting a number of fields to None or other values that indicate the
value is unset, and the test script was checking if the value in the
field didn't evaluate to False in a python 'if' test.

Unfortunately, python evaluates the empty string '' as False in 'if'
tests, resulting in the specific field that contained the empty string
to be dropped from the returned record. This commit fixes that by
special case checking for the empty string.

Signed-off-by: Steve Beattie <email address hidden>
Acked-by: John Johansen <email address hidden>

3679. By John Johansen on 2017-10-18

Fix af_unix downgrade of network rules

with unix rules we output a downgraded rule compatible with network rules
so that policy will work on kernels that support network socket controls
but not the extended af_unix rules

however this is currently broken if the socket type is left unspecified
(initialized to -1), resulting in denials for kernels that don't support
the extended af_unix rules.

cherry-pick: lp:apparmor r3700
Signed-off-by: John Johansen <email address hidden>
Acked-by: timeout

3678. By Christian Boltz on 2017-10-12

Fix save_profiles() for YaST

YaST has two issues in the "save changed profiles" dialog:
- when using "save selected", the list of profiles doesn't get updated.
  Update q.options inside the loop to fix this.
- the list of profiles is displayed as "["/usr/bin/foo", true]" instead
  of just "/usr/bin/foo". Use changed.keys() instead of changed to fix
  this. (text-mode aa-logprof doesn't change, it always displayed
  "/usr/bin/foo" and continues to do so.)

References: https://bugzilla.opensuse.org/show_bug.cgi?id=1062667 part a)

Acked-by: Seth Arnold <email address hidden> for trunk and 2.11.

Note that 2.11 needs a slightly different patch (whitespace diff).