-
apparmor (2.10.95-0ubuntu2.6~14.04.4) trusty-security; urgency=medium
* {,14.04-}lp1788929+1794848.patch:
- disallow writes to thumbnailer dir (LP: #1788929)
- disallow access to the dirs of private files (LP: #1794848)
-- Jamie Strandboge <email address hidden> Thu, 27 Sep 2018 18:38:50 +0000
-
apparmor (2.10.95-0ubuntu2.6~14.04.3) trusty; urgency=medium
* d/p/14.04-profiles-allow-seven-digit-pid-lp1717714.patch:
- Renamed d/p/0001-Allow-seven-digit-pid.patch to mirror other
profiles-14.04 patches naming pattern.
- Modify the existing/renamed patch to use the dir that should be use to
patch a profile. profiles-14.04/ should be use instead of profiles/
which is not use. (LP: #1717714)
-- Eric Desrochers <email address hidden> Fri, 02 Feb 2018 10:19:38 -0500
-
apparmor (2.10.95-0ubuntu2.6~14.04.2) trusty; urgency=medium
* d/p/0001-Allow-seven-digit-pid.patch:
On 64bit systems, /proc/sys/kernel/pid_max can be set to PID_MAX_LIMIT,
(2^22), which results in seven digit pids. Adjust the @{PID} variable in
tunables/global to accept this. (LP: #1717714)
-- Seyeong Kim <email address hidden> Mon, 08 Jan 2018 07:19:22 -0800
-
apparmor (2.10.95-0ubuntu2.6~14.04.1) trusty-security; urgency=medium
* SECURITY UPDATE: Merge from xenial-security to get fix for CVE-2017-6507
* debian/apparmor.postrm: Ensure that a purge of the apparmor package does
not fail if the /var/lib/apparmor/profiles or /var/lib/apparmor
directories do not exist. This purge operation should be considered
successful in that situation. (LP: #1661406)
-- Tyler Hicks <email address hidden> Thu, 16 Mar 2017 01:20:13 +0000
-
apparmor (2.10.95-0ubuntu2.5~14.04.1) trusty; urgency=medium
* Bring apparmor 2.10.95-0ubuntu2.5, from Ubuntu 16.04, to Ubuntu 14.04.
- This allows for proper snap confinement on Ubuntu 14.04 when using the
hardware enablement kernel (LP: #1641243)
* Changes made on top of 2.10.95-0ubuntu2.5:
- debian/apparmor.upstart: Remove the upstart job and continue using the
init script in 14.04
- debian/apparmor.postinst, debian/apparmor-profiles.postinst,
debian/apparmor-profiles.postrm, debian/rules: Revert to using
invoke-rc.d to load the profiles, rather than reloading them directly,
since 14.04 will continue using the init script rather than the upstart
job.
- debian/apparmor.init, debian/lib/apparmor/functions,
debian/apparmor.postinst, debian/apparmor.postrm: Remove functionality
dealing with AppArmor policy in system image based environments since
this 14.04 package will not need to handle such environments. This
removes the handle_system_policy_package_updates(),
compare_previous_version(), compare_and_save_debsums() functions and
their callers.
- debian/apparmor.init: Continue using running-in-container since
systemd-detect-virt doesn't exist on 14.04
- debian/lib/apparmor/functions, debian/apparmor.init: Remove the
is_container_with_internal_policy() function and adjust its call sites
in apparmor.init so that AppArmor policy is not loaded inside of 14.04
LXD containers (avoids bug #1641236)
- debian/lib/apparmor/profile-load, debian/apparmor.install: Remove
profile-load as upstart's apparmor-profile-load is used in 14.04
- debian/patches/libapparmor-mention-dbus-method-in-getcon-man.patch:
Continue applying this patch since the dbus version in 14.04 isn't new
enough to support fetching the AppArmor context from
org.freedesktop.DBus.GetConnectionCredentials().
- debian/patches/libapparmor-force-libtoolize-replacement.patch: Force
libtoolize to replace existing files to fix a libapparmor FTBFS issue on
14.04.
- debian/control: Retain the original 14.04 Breaks and ignore the new
Breaks from 2.10.95-0ubuntu2.5 since they were put in place as part of
the enablement of UNIX domain socket mediation. They're not needed in
this upload since UNIX domain socket mediation is disabled by default so
updates to the profiles included in those packages are not needed.
- Preserve the profiles and abstractions from 14.04's
2.8.95~2430-0ubuntu5.3 apparmor package by recreating them in the
top-level profiles-14.04/ directory of the source. They'll be installed
to debian/tmp/etc/apparmor.d/ during the build process and then to
/etc/apparmor.d/ on package install so that there are no changes to the
shipped profiles or abstractions. The abstractions from
2.10.95-0ubuntu2.5 will be installed into
debian/tmp/snap/etc/apparmor.d/ during the build process and then into
/etc/apparmor.d/snap/abstractions/ on package install for use with snap
confinement. Snap confinement profiles, which includes AppArmor profiles
loaded by snapd and profiles loaded by snaps that are allowed to manage
AppArmor policy, will use the snap abstractions. All other AppArmor
profiles will continue to use the 14.04 abstractions.
- debian/rules: Adjust for new profiles-14.04/ directory
- debian/apparmor-profiles.install: Adjust to install the profiles that
were installed in the 2.8.95~2430-0ubuntu5.3 package
- debian/apparmor.install: Install the abstractions from the
2.10.95-0ubuntu2.5 package into /etc/apparmor.d/snap/abstractions/
- debian/patches/14.04-profiles.patch: Preserve the 14.04 profiles and
abstractions from the 2.8.95~2430-0ubuntu5.3 apparmor package.
- debian/patches/conditionalize-post-release-features.patch: Disable new
mediation features, implemented after the Ubuntu 14.04 release, unless
the profile is for snap confinement. If the profile is for snap
confinement, the abstractions from /etc/apparmor.d/snap/abstractions
will be used and all of the mediation features will be enabled.
- 14.04-add-chromium-browser.patch,
14.04-add-debian-integration-to-lighttpd.patch,
14.04-etc-writable.patch,
14.04-update-base-abstraction-for-signals-and-ptrace.patch,
14.04-dnsmasq-libvirtd-signal-ptrace.patch,
14.04-update-chromium-browser.patch,
14.04-php5-Zend_semaphore-lp1401084.patch,
14.04-dnsmasq-lxc_networking-lp1403468.patch,
14.04-profiles-texlive_font_generation-lp1010909.patch,
14.04-profiles-dovecot-updates-lp1296667.patch,
14.04-profiles-adjust_X_for_lightdm-lp1339727.patch: Import all of the
patches, from 14.04's 2.8.95~2430-0ubuntu5.3 apparmor package, which
patched profiles/ and adjust them to patch profiles-14.04/ instead.
- debian/patches/revert-r2550-and-r2551.patch: Revert two upstream changes
to mod_apparmor which could potentially regress existing users of
mod_apparmor in 14.04. These upstream changes are not appropriate for an
SRU.
-- Tyler Hicks <email address hidden> Wed, 30 Nov 2016 16:36:02 +0000
-
apparmor (2.8.95~2430-0ubuntu5.3) trusty-proposed; urgency=medium
* debian/apparmor-profiles.install: add missing dovecot profiles
(LP: #1296667)
-- Steve Beattie <email address hidden> Fri, 12 Jun 2015 23:21:58 -0700
-
apparmor (2.8.95~2430-0ubuntu5.2) trusty-proposed; urgency=medium
* debian/patches/php5-Zend_semaphore-lp1401084.patch: allow php5
abstraction access to Zend opcache files (LP: #1401084)
* debian/patches/dnsmasq-lxc_networking-lp1403468.patch: update
profile for lxc support (LP: #1403468)
* debian/patches/profiles-texlive_font_generation-lp1010909.patch:
allow generation of texlive fonts by sanitized-helpers
(LP: #1010909)
* debian/apport/source_apparmor.py: fix the apparmor apport hook
so it does not raise an exception if a non-unicode character is
found in /var/log/kern.log or in /var/log/syslog. This should
work under python3 or python2.7 (LP: #1304447)
* debian/patches/profiles-dovecot-updates-lp1296667.patch: update
dovecot profiles to address several missing permissions.
(LP: #1296667)
* debian/patches/profiles-adjust_X_for_lightdm-lp1339727.patch:
adjust X abstraction for LightDM xauthority location (LP: #1339727)
* debian/patches/libapparmor-fix_memory_leaks-lp1340927.patch; fix
memory leaks in log parsing component of libapparmor (LP: #1340927)
* debian/patches/libapparmor-another_audit_format-lp1399027.patch:
add support for another log format style (LP: #1399027)
* debian/patches/tests-workaround_for_unix_socket_change-lp1425398.patch:
work around apparmor kernel behavioral change in regression tests
(LP: #1425398)
* debian/control: add breaks on python3-apparmor against older
apparmor-utils that used to be where python bits lived
(LP: #1373259)
* debian/patches/utils-update_to_2.9.2.patch: update the python
utilities to the upstream 2.9.2 (LP: #1449769, incorporating a
large number of fixes and improvements, including:
- fix aa-genprof traceback with apparmor 2.8.95 (LP: #1294797)
- fix aa-genprof crashing when selecting scan on Ubuntu 14.04 server
(LP: #1319829)
- make aa-logprof read profile instead of program binary
(LP: #1317176, LP: #1324154)
- aa-complain: don't traceback when marking multiple profiles
(LP: #1378095)
- make python tools able to parse mounts with UTF-8 non-ascii
characters (LP: #1310598)
-- Steve Beattie <email address hidden> Thu, 30 Apr 2015 12:18:08 -0700
-
apparmor (2.8.95~2430-0ubuntu5.1) trusty-security; urgency=medium
* SECURITY UPDATE: An AppArmor profile compilation bug may result in
applications being confined in a way that is inconsistent with the profile
author's intent. The compilation bug is specific to certain combinations
of AppArmor rule types and conditionals of those rule types.
(LP: #1390592)
- debian/patches/fix-esc-seq-interp.patch: Fix the profile compilation bug
by limiting the number of bytes that are consumed when interpreting
hexadecimal, octal, and decimal escape sequences
- debian/patches/tests-allow-arbitrary-profile-names.patch,
debian/patches/tests-add-ptrace-tests-for-lp1390592.patch: Add
regression tests for the profile compilation bug
- CVE-2014-1424
-- Tyler Hicks <email address hidden> Fri, 14 Nov 2014 13:46:22 -0600
-
apparmor (2.8.95~2430-0ubuntu5) trusty; urgency=medium
* debian/control: add versioned Breaks to apparmor for lxc, libvirt-bin,
lightdm and apparmor-easyprof-ubuntu
apparmor (2.8.95~2430-0ubuntu4) trusty; urgency=medium
[ John Johansen, Steve Beattie ]
* Add userspace support for AppArmor signals and ptrace mediation
(LP: #1298611)
+ debian/patches/mediate-signals.patch,
debian/patches/change-signal-syntax.patch: Parse signal rules with
apparmor_parser. See the apparmor.d(5) man page for syntax details.
+ debian/patches/change-ptrace-syntax.patch,
debian/patches/mediate-ptrace.patch: Parse ptrace rules with
apparmor_parser. See the apparmor.d(5) man page for syntax details.
+ debian/patches/test-signal-rules.patch,
debian/patches/test-ptrace-rules.patch,
debian/patches/update-tests-for-new-semantics.patch: Update existing
tests and add new tests for signal and ptrace mediation
+ debian/patches/fix-garbage-in-preprocessor-output.patch: Fix bug causing
apparmor_parser preprocessor output to contain garbage after include
statements
+ debian/patches/fix-double-comma-in-preprocessor-output.patch: Fix bug
causing apparmor_parser preprocessor output to contain double commas
after some rules
+ debian/patches/symtab-tests-and-seenlist-bug.patch,
debian/patches/add-profile-name-variable.patch: Add ${profile_name}
variable for use in profiles when rules need to specify the current
profile's name. This is useful for signal and ptrace rules that specify
+ debian/patches/fix-names-treated-as-condlistid.patch: Fix
apparmor_parser bug that caused mount and dbus rules to fail for sets of
values
[ Jamie Strandboge ]
* debian/patches/update-base-abstraction-for-signals-and-ptrace.patch:
Adjust the base abstraction for signals and ptrace mediation. Profiles
that use the base abstraction can deny any of the granted permissions to
achieve tighter confinement.
* debian/patches/manpage-signal-ptrace.patch: Update the apparmor.d man
page to document signal rules, ptrace rules, and variables for use in
AppArmor profiles
* debian/patches/dnsmasq-libvirtd-signal-ptrace.patch: Update the dnsmasq
profile to allow libvirtd to send signals to and ptrace read the dnsmasq
process
* debian/patches/update-chromium-browser.patch: Adjust the chromium-browser
profile for permissions needed in newer chromium-browser versions and add
the rules needed for AppArmor ptrace mediation
[ Tyler Hicks ]
* Add new rule type support to aa.py to fix tracebacks when using the Python
utilities in apparmor-utils on systems with AppArmor profiles containing
previously unsupported rule types
- debian/patches/python-utils-file-support.patch: Support path rules
containing the "file" prefix (LP: #1295346)
- debian/patches/python-utils-signal-support.patch: Parse and write signal
rules (LP: #1300316)
- debian/patches/python-utils-ptrace-support.patch: Parse and write ptrace
rules (LP: #1300317)
- debian/patches/python-utils-pivot_root-support.patch: Parse and write
pivot_root rules (LP: #1298678)
-- Jamie Strandboge <email address hidden> Fri, 04 Apr 2014 01:07:24 -0500
-
apparmor (2.8.95~2430-0ubuntu3) trusty; urgency=medium
[ Jamie Strandboge ]
* debian/lib/apparmor/functions: properly calculate number of profiles in
/var/lib/apparmor/profiles (LP: #1295816)
* autostart aa-notify via /etc/xdg/autostart instead of /etc/X11/Xsession.d
(LP: #1288241)
- remove debian/notify/90apparmor-notify
- add debian/notify/apparmor-notify.desktop
- debian/apparmor-notify.install: adjust for the above
- add debian/apparmor-notify.maintscript to remove 90apparmor-notify
* debian/notify/notify.conf: use_group should be set to "sudo" instead of
"admin" (LP: #1009666)
[ Tyler Hicks ]
* debian/patches/initialize-mount-flags.patch: Initialize the variables
containing mount rule flags to zero. Otherwise, the parser may set
unexpected bits in the mount flags field for rules that do not specify
mount flags. The uninitialized mount flag variables may have caused
unexpected AppArmor denials during mount mediation. (LP: #1296459)
* debian/patches/fix-typo-in-dbus_write.patch: Fix a bug in the
apparmor/aa.py module that caused the utilities in the apparmor-utils
package to write out network rules instead of dbus rules
* debian/patches/limited-mount-rule-support.patch: Fix a bug in the
apparmor/aa.py module that caused the utilities in the apparmor-utils
package to traceback when encountering a mount rule (LP: #1294825)
* debian/patches/bare-capability-rule-support.patch: Fix a bug in the
apparmor/aa.py module that caused the utilities in the apparmor-utils
package to traceback when encountering a bare capability rule
(LP: #1294819)
* debian/patches/check-config-for-sysctl.patch,
debian/patches/increase-swap-size.patch: Fix bugs in the regression test
suite that caused errors when running on ppc64el
* debian/patches/test-v6-policy.patch,
debian/patches/test-mount-mediation.patch: Improve the regression tests
by increasing the mount rule test coverage
-- Tyler Hicks <email address hidden> Thu, 27 Mar 2014 14:12:29 -0500
-
apparmor (2.8.95~2430-0ubuntu2) trusty; urgency=medium
* debian/control: Depends on python-pkg-resources for python-apparmor and
python3-pkg-resources for python3-apparmor to fix autopkgtests in
click-apparmor and apparmor-easyprof-ubuntu
-- Jamie Strandboge <email address hidden> Thu, 20 Mar 2014 19:33:51 -0500
-
apparmor (2.8.95~2430-0ubuntu1) trusty; urgency=low
[ Jamie Strandboge ]
* debian/debhelper/dh_apparmor: exit with error if aa-easyprof does not
exist
* debian/control: drop Depends on apparmor-easyprof to Suggests for
dh-apparmor
[ Seth Arnold, Jamie Strandboge, Steve Beattie, John Johansen, Tyler Hicks ]
* New upstream snapshot (LP: #1278702, #1061693, #1285653) dropping very
large Ubuntu delta and fixing the following bugs:
- Adjust fonts abstraction for libthai (LP: #1278702)
- Support translated XDG user directories (LP: #1061693)
- Adjust abstractions/web-data to include /var/www/html (LP: #1285653)
Refresh 0002-add-debian-integration-to-lighttpd.patch to include
/etc/lighttpd/conf-available/*.conf
- Adjust debian/libapparmor1.symbols to reflect new upstream versioning
for the aa_query_label() function
- Raise exceptions in Python bindings when something fails
* ship new Python replacements for previous Perl-based tools
- debian/apparmor-utils.install: remove usr/share/perl5/Immunix/*.pm and
add usr/sbin/aa-autodep, usr/sbin/aa-cleanprof and usr/sbin/aa-mergeprof
- debian/control:
+ remove various Perl dependencies
+ add python-apparmor and python3-apparmor
+ python3-apparmor Breaks: apparmor-easyprof to move the file since it
ships dist-packages/apparmor/__init__.py now
- debian/apparmor-utils.manpages: ship new manpages for aa-cleanprof and
aa-mergeprof
- debian/rules: build and install Python tools
* debian/apparmor.install:
- install apparmorfs, dovecot, kernelvars, securityfs, sys,
and xdg-user-dirs tunables and xdg-user-dirs.d directory
* debian/apparmor.dirs:
- install /etc/apparmor.d/tunables/xdg-user-dirs.d
* debian/rules: delete upstream-provided xdg-user-dirs.d/site.local
* debian/apparmor.postinst: create xdg-user-dirs.d/site.local
* debian/apparmor.postrm: remove xdg-user-dirs.d
* Remaining patches:
- add-chromium-browser.patch
- add-debian-integration-to-lighttpd.patch
- ubuntu-manpage-updates.patch
- libapparmor-layout-deb.patch
- libapparmor-mention-dbus-method-in-getcon-man.patch
- etc-writable.patch
- aa-utils_are_bilingual.patch
* New patches:
- convert-to-rules.patch
- list-fns.patch
- parse-mode.patch
- add-decimal-interp.patch
- policy_mediates.patch
- fix-failpath.patch
- feature_file.patch
- fix-network.patch
- aare-to-class.patch
- add-mediation-unix.patch
- parser_version.patch
- caching.patch
- label-class.patch
- fix-lexer-debug.patch
- use-diff-encode.patch
- fix-serialize.patch
- fix-ppc-endian-ftbfs.patch
- opt_arg.patch
- tests-cond-dbus.patch
* Move manpages from libapparmor1 to libapparmor-dev
- debian/libapparmor-dev.manpages: install aa_change_hat.2,
aa_change_profile.2, aa_find_mountpoint.2, aa_getcon.2
- debian/control: libapparmor-dev Replaces: and Breaks: libapparmor1
* Move /usr/lib/python3/dist-packages/apparmor/__init__.py from
apparmor-easyprof to python3-apparmor
- debian/control: python3-apparmor Breaks: apparmor-easyprof
- debian/apparmor-easyprof.install: remove
usr/lib/python*.*/site-packages/apparmor*
* New profiles and abstractions:
- debian/apparmor.install: tunables/dovecot, tunables/kernelvars,
tunables/xdg-user-dirs, tunables/xdg-user-dirs.d
apparmor (2.8.94-0ubuntu1.4) trusty; urgency=low
* Test merge from upstream new pyutils branch (rev 2385)
-- Seth Arnold <email address hidden> Wed, 19 Mar 2014 20:29:27 -0700
-
apparmor (2.8.0-0ubuntu38) trusty; urgency=low
[ Tyler Hicks ]
* 0084-parser-add-dbus-eavesdrop-perm.patch: Add an eavesdrop permission to
the dbus rule type, allowing confined applications to eavesdrop. The only
valid conditional for eavesdrop rules is 'bus'. See the apparmor.d(5) man
page for more information. (LP: #1262440)
[ Steve Beattie ]
* 0085-push-normalize-tree-ops-into-expr-tree-classes.patch: Improve
parser performance in some cases
[ John Johansen ]
* 0086-add-diff-state-compression-to-dfa.patch: Implement differential
state compression in the parser
* 0087-fix-dfa-minimization.patch: Fix a parser bug that caused some DFAs to
not be fully minimized (LP: #1262938)
* 0088-fix-pol-generation-for-small-dfas.patch: Fixes bugs in the parser
when generating policy for some small DFAs
-- Tyler Hicks <email address hidden> Mon, 13 Jan 2014 11:17:42 -0600
-
apparmor (2.8.0-0ubuntu37) trusty; urgency=low
[ Jan Rękorajski ]
* 0082-parser-fix-FTBFS-with-bison-3.patch: Fix parser FTBFS with bison 3
[ Steve Beattie ]
* 0083-libapparmor-require-libtoolize.patch: Fix FTBFS by switching
the autogen.sh script to use libtoolize instead of libtool
-- Tyler Hicks <email address hidden> Fri, 10 Jan 2014 13:48:43 -0600
-
apparmor (2.8.0-0ubuntu36) trusty; urgency=medium
* Rebuild for python3.4 as a supported python version.
-- Matthias Klose <email address hidden> Sat, 04 Jan 2014 18:30:59 +0000
-
apparmor (2.8.0-0ubuntu35) trusty; urgency=low
* abstractions/nameservice: Also allow access to the sssd nss pipe.
-- Stephane Graber <email address hidden> Fri, 29 Nov 2013 13:44:49 -0500
-
apparmor (2.8.0-0ubuntu34) trusty; urgency=low
[ Tyler Hicks ]
* 0078-parser-check-for-dbus-kernel-support.patch: The parser should not
include D-Bus rules in the binary policy that it loads into the kernel if
the kernel does not support D-Bus rules (LP: #1231778)
* 0079-utils-ignore-unsupported-log-events.patch: aa-logprof should ignore
audit events that it does not yet support instead of treating them as
errors (LP: #1243932)
* 0080-tests-use-ldconfig-for-library-detection.patch: Fix libapparmor
detection in regression tests after the multiarch changes
[ Jamie Strandboge ]
* 0081-python-abstraction-updates.patch: Add rules in support of Python 3.3
[ Chad Miller ]
* debian/patches/0001-add-chromium-browser.patch: Follow new chromium-browser
sandbox name. Keep old name for now to allow transition. LP: #1247269
-- Tyler Hicks <email address hidden> Mon, 04 Nov 2013 15:57:30 -0800
-
apparmor (2.8.0-0ubuntu33) trusty; urgency=low
* Convert to dh.
* Bump to debhelper compat level 9 for multiarch support.
* Mark libapparmor1, libapparmor-dev Multi-Arch: same. LP: #1246067.
-- Steve Langasek <email address hidden> Thu, 31 Oct 2013 13:23:57 -0700
-
apparmor (2.8.0-0ubuntu32) trusty; urgency=low
* no change rebuild for perl 5.18
-- Jamie Strandboge <email address hidden> Mon, 21 Oct 2013 13:28:26 -0500
-
apparmor (2.8.0-0ubuntu31) saucy; urgency=low
* 0077_aa-status-is-bilingual.patch: aa-status was written to work with
python 2 or 3. Upstream is still using 2, so adjust ours to use
/usr/bin/python3 to avoid pulling python 2 back to the desktop images
-- Jamie Strandboge <email address hidden> Fri, 11 Oct 2013 15:35:03 -0500
