Sorry these got lost in the mail black hole and I would have completely missed them if they hadn't been pointed out to me. I am missing the original message ids so, this is being done as a new message quoting the originals
>> Hi, >> >> it's being discussed [1] what version of the AppArmor userspace we'll >> ship in Debian Jessie. >> > That is, most likely: 3.16. In case it changes anything wrt. > the timing of pushing AppArmor patches to Linux mainline. > There might be a few but nothing significant >> On the kernel side, most likely we'll have what is in the mainline >> version of Linux that is chosen for Jessie; possibly a few backports >> of things that land into mainline after this kernel is released might >> be added on top, but I don't think we'll have any out-of-tree patches. >> the situation here is better as the main interface patches have landed, now its just the extended mediation patches, most of which are dependent on the core rework. >> On the userspace side, we currently have 2.8.0 (!), and hopefully >> we'll get 2.8.3 soonish. For Jessie, I think we basically have to >> choose between 2.8.3 and 2.8.95. >> 2.8.4 should be out in a few weeks also I expect the next 2.9 beta, which will be 2.8.96 will also ship in a few weeks. The reason we do the betas as 2.8.XX where XX is a big number is incompatibilities between rpm and debian packaging around naming (2.9~Beta1, and different similar names caused problems with one or the other). >> I've read on the relevant Ubuntu freeze-exception request [2] that >> AppArmor 2.8.95 was tested with Ubuntu kernels, with and without the >> ptrace and signal mediation ones. >> yes, part of the testing is against the vanilla upstream kernel. >> That's good to know, but I'm wondering if anyone has tested AppArmor >> 2.8.95 without out-of-tree kernel patches at all, using this >> combination in production, and/or shipping it to users. >> I have run tests on it, and brought up systems with it. It should work but I can't say I know of anyone shipping 2.8.95 with a vanilla kernel. >> Has anyone here any experience to share on this topic? Basically we try to keep apparmor kernel and userspace somewhat independent. That is the kernel tries to maintain backwards compatibility with older userspaces, and newer userspaces try to remain compatible with older kernels. Ubuntu does have some combinations that do test some of these configurations. Eg. the backport kernels take the newer kernels and put them on older userspaces. So we have a trusty (3.13 kernel + out of tree patches) back on precise with is basically a 2.8 userspace. At the moment Ubuntu doesn't support a newer userspace on older kernels but part of the validation process (for apparmor) is testing against vanilla upstream. The regression tests on the 2.8.95 userspace check the kernel for supported features and run different tests. While old userspace to new kernel, and new kernel space are pretty good, where we currently run into problems is policy. Old userspaces don't like new policy with knew unknown rules, and old policy on new userspace + kernels may interpret missing rules as lack of permission instead of the policy having been authored for an older version. We have plans to address this but they are done yet. Basically policy will pick up some version tagging, some new compiler defined variables, and there will be a template rule type to allow defining rule patterns the compiler doesn't know about. An older compiler (parser) will be able to deal with knew unknown rule types via some includes that tell the parser what to ignore, older parsers won't compile the rule but will be able to successful ignore it. And newer parsers will be able to pick out semantics due to version tagging. It sounds like a lot but it is going to be needed for policy that is shipped in different packages and should also help with sharing policy between distros >> Thanks in advance! >> >> [And very sorry for not having followed-up yet on the thread I've >> started about sharing profiles maintenance..] >> >> [1] https://bugs.debian.org/746764 >> [2] https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1298611 -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
