Public bug reported: [ Impact ]
This SRU for a 5.0.2 backport contains a large number of fixes: 5.0.0~beta1 to 5.0.0~rc1 --- utils: ignore file log events without filename (https://gitlab.com/apparmor/apparmor/-/merge_requests/1926) 5.0.0~rc1 to 5.0.0~rc2 --- profiles: authentication: allow subdirs of /usr/etc/security (https://gitlab.com/apparmor/apparmor/-/merge_requests/2007) binutils: fix aa-status JSON when no policy is loaded (https://gitlab.com/apparmor/apparmor/-/merge_requests/1653) parser: support network iface conditional (https://gitlab.com/apparmor/apparmor/-/merge_requests/2012) 5.0.0~rc2 to 5.0.0~rc3 consists of a single FTBFS merge fix that was already carried as a Ubuntu delta --- 5.0.0~rc3 to 5.0.0~rc4 --- profiles: fix useradd --create-home and use etc abstraction (https://gitlab.com/apparmor/apparmor/-/merge_requests/2015) parser: fix various format string and memory safety issues (Gitlab MR 2020, 2021, 2022, 2023, 2025, 2026, 2027, 2028, 2029, 2030, 2031, 2032, 2033, 2024, 2034, 2036, 2038, 2039, 2040, 2041, 2042, 2043) profiles: lsusb: silently deny capability requests from lsusb (https://gitlab.com/apparmor/apparmor/-/merge_requests/1909) profiles: add support for Brave Origin in the brave profile (https://gitlab.com/apparmor/apparmor/-/issues/612, https://gitlab.com/apparmor/apparmor/-/merge_requests/2049) 5.0.0~rc4 to 5.0.0~rc5 --- utils: testing updates (https://gitlab.com/apparmor/apparmor/-/merge_requests/2055, https://gitlab.com/apparmor/apparmor/-/merge_requests/2054) profiles: add PSI abstraction (https://gitlab.com/apparmor/apparmor/-/merge_requests/2010) parser: fix O(m*n) blowup in network port rules (https://gitlab.com/apparmor/apparmor/-/merge_requests/2053) profiles: skip cache and kernel load when test-compiling profiles (https://gitlab.com/apparmor/apparmor/-/merge_requests/2056) parser: link libzstd statically when building statically (https://gitlab.com/apparmor/apparmor/-/merge_requests/2061) parser: rework Makefile to use CXXFLAGS (https://gitlab.com/apparmor/apparmor/-/merge_requests/2059) profiles: add non-default abi with iface (https://gitlab.com/apparmor/apparmor/-/merge_requests/2064) profiles: lsblk: allow PNP*00 (https://gitlab.com/apparmor/apparmor/-/merge_requests/2066) 5.0.0~rc5 to 5.0.0 --- profiles: support uucore locales (https://gitlab.com/apparmor/apparmor/-/merge_requests/2068, LP: #2158941) profiles: standardize attach_disconnected.path to /att/$profile_name (https://gitlab.com/apparmor/apparmor/-/merge_requests/2069) 5.0.0 to 5.0.1 --- libapparmor: (https://gitlab.com/apparmor/apparmor/-/merge_requests/2126, https://gitlab.com/apparmor/apparmor/-/issues/636) - strip header before kernel write if needed (https://gitlab.com/apparmor/apparmor/-/merge_requests/2100, https://gitlab.com/apparmor/apparmor/-/merge_requests/2124) - fix classification of change_profile events (https://gitlab.com/apparmor/apparmor/-/merge_requests/2075) - fix invalid read on dir buffer (https://gitlab.com/apparmor/apparmor/-/merge_requests/2141) utils: - avoid logprof crash with change_onexec - aa-notify: - improvements around privilege dropping (https://gitlab.com/apparmor/apparmor/-/merge_requests/2093) - catch DBusException on too many events (https://gitlab.com/apparmor/apparmor/-/merge_requests/2092) - aa-show-usage: avoid exponential brace expansion in file matching (https://gitlab.com/apparmor/apparmor/-/merge_requests/2129) parser: - fix mount parsing and variables regression (https://gitlab.com/apparmor/apparmor/-/merge_requests/2089, https://gitlab.com/apparmor/apparmor/-/issues/624) - fix link rules counting against the transition limit (https://gitlab.com/apparmor/apparmor/-/merge_requests/2082, https://gitlab.com/apparmor/apparmor/-/issues/547) - emit header for OFILE output (https://gitlab.com/apparmor/apparmor/-/merge_requests/2100, https://gitlab.com/apparmor/apparmor/-/issues/626) - fix yacc generated yyerror message for -Wno-error=format-security (https://gitlab.com/apparmor/apparmor/-/merge_requests/2133) - fix compressed cache headers (https://gitlab.com/apparmor/apparmor/-/merge_requests/2100) profiles: - abstractions: - alts: new abstraction (https://gitlab.com/apparmor/apparmor/-/merge_requests/2121) - fonts: Allow fontmatrix location under @{HOME}/.local/share/ in the fonts abstraction (https://gitlab.com/apparmor/apparmor/-/merge_requests/2098) - dovecot-common: Allow @{run}/dovecot/stats-writer rw, (https://gitlab.com/apparmor/apparmor/-/merge_requests/2074) - glycin: new abstraction (https://gitlab.com/apparmor/apparmor/-/merge_requests/2084) - nameservice, nameservice-strict: unify run resolv.conf (https://gitlab.com/apparmor/apparmor/-/merge_requests/2101, BOO:1265394) - wutmp: Updates from usage monitoring (particularly on Ubuntu 26.04) (https://gitlab.com/apparmor/apparmor/-/merge_requests/2128) - profiles: - add check for disconnected path flag (https://gitlab.com/apparmor/apparmor/-/merge_requests/2106) - alsamixer: update alsamixer profile (https://gitlab.com/apparmor/apparmor/-/merge_requests/2108, BOO:1265452) - avahi-daemon: allow writing to disconnected /systemd/ paths (https://gitlab.com/apparmor/apparmor/-/merge_requests/2116, BOO:1266041) - chromium_browser: Updates from usage monitoring (particularly on Ubuntu 26.04) (https://gitlab.com/apparmor/apparmor/-/merge_requests/2128) - curl: allow reading rpmdevtools curlrc (https://gitlab.com/apparmor/apparmor/-/merge_requests/2125, BOO:1266273) - dig: fix dig profile on opensuse (https://gitlab.com/apparmor/apparmor/-/merge_requests/2105, BOO:1265459) - dovecot: - allow to read / (https://gitlab.com/apparmor/apparmor/-/merge_requests/2079, BOO:1263051) - allow access to the dovecot/dict socket (https://gitlab.com/apparmor/apparmor/-/merge_requests/2074) - allow access to the auth-userdb socket, and to /var/spool/postfix/private/dovecot-lmtp which is used for delivering the mails from postfix to dovecot-lmtp (https://gitlab.com/apparmor/apparmor/-/merge_requests/2074) - firefox: Updates from usage monitoring (particularly on Ubuntu 26.04) (https://gitlab.com/apparmor/apparmor/-/merge_requests/2128) - fusermount3: - Fix fusermount3 profile for openSUSE (https://gitlab.com/apparmor/apparmor/-/merge_requests/2113, BOO:1265951) - add missing machine-id to fusermount3 (https://gitlab.com/apparmor/apparmor/-/merge_requests/2132) - glycin: - new glycin.bwrap, and glycin.loaders profiles (https://gitlab.com/apparmor/apparmor/-/merge_requests/2084, https://gitlab.com/apparmor/apparmor/-/merge_requests/2094) - Updates from usage monitoring (particularly on Ubuntu 26.04) (https://gitlab.com/apparmor/apparmor/-/merge_requests/2128) - lsblk: allow reading devices - needed for --fs (https://gitlab.com/apparmor/apparmor/-/merge_requests/2117) - lsof: allow reading @{PROC}/@{pids}/attr/current (https://gitlab.com/apparmor/apparmor/-/merge_requests/2118) - lsusb: allow reading uevent file (https://gitlab.com/apparmor/apparmor/-/merge_requests/2102, LP: #2158939) - php-fpm: allow writing to disconnected /systemd/notify (https://gitlab.com/apparmor/apparmor/-/merge_requests/2122, BOO:1265864) - plasmashell - allow disconnected systemd/journal/socket (https://gitlab.com/apparmor/apparmor/-/merge_requests/2119) - add mediate_deleted to plasmashell (!2131 (merged)) - postfix: allow to read / (https://gitlab.com/apparmor/apparmor/-/merge_requests/2087) - proftpd: Fix proftpd profile for openSUSE (https://gitlab.com/apparmor/apparmor/-/merge_requests/2114, BOO:1265862) - nscd: make the nslcd socket attachment relative (https://gitlab.com/apparmor/apparmor/-/merge_requests/2140) - Samba: allow disconnected systemd/ paths (https://gitlab.com/apparmor/apparmor/-/merge_requests/2112, BOO:1265865) - smbd: - allow to read / (https://gitlab.com/apparmor/apparmor/-/merge_requests/2079, BOO:1263051) - allow access to winbind/pipe (BOS:1267425) - syslog-ng: avoid double slash in @{CHROOT_BASE}@{run} (https://gitlab.com/apparmor/apparmor/-/merge_requests/2090) - systemd-detect-virt: Update systemd-detect-virt profile for openSUSE (https://gitlab.com/apparmor/apparmor/-/merge_requests/2120) - tnftp: Updates from usage monitoring (particularly on Ubuntu 26.04) (https://gitlab.com/apparmor/apparmor/-/merge_requests/2128) - zgrep: Gentoo Linux gzip-reference, (https://gitlab.com/apparmor/apparmor/-/merge_requests/2134, https://bugs.gentoo.org/911146) - transmission: Update transmission-daemon for openSUSE Tumbleweed (https://gitlab.com/apparmor/apparmor/-/merge_requests/2115) - usr.sbin.nscd: Updates from usage monitoring (particularly on Ubuntu 26.04) (https://gitlab.com/apparmor/apparmor/-/merge_requests/2128) - who: - Fix who profile for openSUSE (https://gitlab.com/apparmor/apparmor/-/merge_requests/2109, BOO:1265860) - allow reading uutils Fluent locale files (https://gitlab.com/apparmor/apparmor/-/merge_requests/2096) - wpa_supplicant: Fix wpa_supplicant profile on openSUSE (https://gitlab.com/apparmor/apparmor/-/merge_requests/2103, BOO:1265377) - Xorg: Updates from usage monitoring (particularly on Ubuntu 26.04) (https://gitlab.com/apparmor/apparmor/-/merge_requests/2128) 5.0.1 to 5.0.2 --- utils: - return None when creating a rule from an invalid event (https://gitlab.com/apparmor/apparmor/-/merge_requests/2155, https://gitlab.com/apparmor/apparmor/-/issues/643) parser: - fix support for different versions of permstable32 (https://gitlab.com/apparmor/apparmor/-/merge_requests/1932) - fix generation of compat_net table (https://gitlab.com/apparmor/apparmor/-/merge_requests/2153) - fix minimization of start and non accepting states (https://gitlab.com/apparmor/apparmor/-/merge_requests/2144) - support diff-encoded policy in upstream kernel (https://gitlab.com/apparmor/apparmor/-/merge_requests/2146) policy: - profiles: - alsamixer: add asound configs (LP: #2157575) - lsblk: allow reading / to fix FSTYPE and UUID listing (https://gitlab.com/apparmor/apparmor/-/merge_requests/2147) - postfix: Fix disconnected paths in postalias profile (https://gitlab.com/apparmor/apparmor/-/merge_requests/2163) 5.0.2 to 5.0.2-0ubuntu1 --- - profiles: add file chooser rules to abstractions/transmission-common (LP: #2152079) [ Test Plan ] The QRT test suite contains extensive tests of AppArmor and includes execution of the AppArmor test suite via `ApparmorTestsuites`. * To prepare the QRT test suite (can be done on any machine): - `git clone https://git.launchpad.net/qa-regression-testing` - `./scripts/make-test-tarball ./scripts/test-apparmor.py` * To run the QRT test suite: - Copy the tarball onto the machine with the new AppArmor installed and extract it - `sudo ./install-packages test-apparmor.py` - Reboot the machine - `sudo ./test-apparmor.py -v` There are additional test plans in each of the four linked Launchpad bugs. [ Where problems could occur ] This SRU moves from an upstream beta release to a final release that contains many bug fixes, allowing for a number of vendored bugfix patches to be dropped. The changelog in the impact section above omit changes that were already previously vendored into the Ubuntu package. Some of these changes are to the abstractions used by profiles, which may cause a one-time slower boot due to recompilation of the profiles using those abstractions. At the same time, changes to the profiles and abstractions are generally loosening confinement, so previously allowed actions would not be newly restricted. (It is possible, however, that updates to the parser might cause compilation regressions.) The new release includes additional work around network interface based mediation. Use of such mediation is opt-in (and requires the use of a non-default ABI), but these changes might cause regressions for users of this feature. The new release also enables the diff-encode feature when paired with newer upstream kernels. Users of these upstream kernels may thus encounter latent bugs in the diff-encode feature. [ Other info ] This is a backport of the 5.0.2-0ubuntu1 release currently in 26.10 back into 26.04. As of this writing, 5.0.2-0ubuntu1 is still in -proposed in 26.10, due to a large autopkgtest backlog. ** Affects: apparmor (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2161458 Title: AppArmor 5.0.2 backport for 26.04 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2161458/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
