!. Yes the whole AppArmor stack is active, only unconfined gets the early bailout 2. lsm.c does allow buffer size modification but it is capped at 2xPATH_MAX, which is dependent on the page size, and should only be done at boot, as a kernel arg. 3. default_allow is not equivalent to unconfined. It may get mapped to unconfined, but is not necessarily so, it will depend on the kernel, and appamror version. Which means it doesn't necessarily skip the mediation stack. 4. If you want unconfined's behavior, you are safer going with the unconfined flag. However it doesn't allow overriding the default behavior of pix atm (and when it does that won't skip the mediation stack).
As it stands this "fix" will either apply the allow_all rule as the profile currently does OR it will map to unconfined, which is the only way to by-pass the mediation stack. If it maps to unconfined this replaces "ix" with "pix" which means system confinement will get applied in the schroot. How much of a problem this is will depend on how the schroot is constructed, chroots, vs. pivot_root, bind mounts, vs. being stand alone ... -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2161302 Title: sbuild profile is not equivalent to unconfined To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2161302/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
