AppArmor 2.10.5

Introduction
AppArmor 2.10.5 is a maintenance release of the user space components
of the AppArmor security project. The kernel portion of the project
is maintained and pushed separately.
This version of the userspace should work with all kernel versions from
2.6.15 and later (some earlier version of the kernel if they have the
apparmor patches applied).
AppArmor 2.10.5 was released 2019-06-15.

Obtaining the Release
These release notes cover all changes between 2.10.4 (758ec0cd) and 2.10.5 (6a871a50) apparmor-2.10 branch.
Tarball

https://launchpad.net/apparmor/2.10/2.10.5/+download/apparmor-2.10.5.tar.gz
sha256sum: 94d6db4789423ed6f025e939b12720e1b8536a1dfabb0ff5f3265a584314bf8a
signature: https://launchpad.net/apparmor/2.10/2.10.5/+download/apparmor-2.10.5.tar.gz.asc

Changes in This Release

Build Infrastructure

add files to .gitignore

parser/libapparmor_re/parse.cc is autogenerated during build (MR319)
parser/tst_lib gets compiled during "make check" (MR319)
swig auto generated files for ruby (MR366)

fix libapparmor swig 4 failure 'aa_log_record' object has no attribute '__getattr__' (BUG33)

Policy Compiler (a.k.a apparmor_parser)

fix abi rule skipping core dump on bad file names (MR298)
fix parsing of target profile NAME in directed transitions “px -> NAME" (MR334)

Policy

Profiles

dnsmasq:

add permission to open log files

dovecot:

allow FD passing between dovecot and dovecot's anvil (MR336)
allow chroot'ing the auth processes (MR336)
let dovecot/anvil rw the auth-penalty socket (MR336)
auth processes need to read from postfix auth socket (MR336)
add abstractions/ssl_certs to lmtp (MR336)
allow master to use SIGTERM on children that are slow to die (MR357)

identd: allow network netlink dgram (MR353)
syslog-ng: add abstractions/python for python-parser (MR361)

Abstractions

fonts:

allow to read conf-avail dir itself (MR165)
add various openSUSE-specific font config directories (MR309)

nameservice: allow access to /run/netconfig/resolv.conf (bso1097370)
qt5-compose-cache-write: fix anonymous shared memory access (MR301)
qt5-settings-write: fix anonymous shared memory access (MR302)
ssl_certs,keys: add support for libdehydrated in /var/lib/ (MR299)

Tests

fix mount test to use next available loop device (MR379)