-
apparmor (2.8.0-0ubuntu31.1) saucy-proposed; urgency=low
* 0078-parser-check-for-dbus-kernel-support.patch: The parser should not
include D-Bus rules in the binary policy that it loads into the kernel if
the kernel does not support D-Bus rules (LP: #1231778)
* 0079-utils-ignore-unsupported-log-events.patch: aa-logprof should ignore
audit events that it does not yet support instead of treating them as
errors (LP: #1243932)
-- Tyler Hicks <email address hidden> Mon, 04 Nov 2013 13:22:22 -0800
-
apparmor (2.8.0-0ubuntu31) saucy; urgency=low
* 0077_aa-status-is-bilingual.patch: aa-status was written to work with
python 2 or 3. Upstream is still using 2, so adjust ours to use
/usr/bin/python3 to avoid pulling python 2 back to the desktop images
-- Jamie Strandboge <email address hidden> Fri, 11 Oct 2013 15:35:03 -0500
-
apparmor (2.8.0-0ubuntu30) saucy; urgency=low
[ Tyler Hicks ]
* debian/patches/0059-dbus-rules-for-dbus-abstractions.patch: Add an
abstraction for the accessibility bus. It is currently very permissive,
like the dbus and dbus-session abstractions, and grants all permissions on
the accessibility bus. (LP: #1226141)
* debian/patches/0071-lp1226356.patch: Fix issues in parsing D-Bus and mount
rules. Both rule classes suffered from unexpected auditing behavior when
using the 'deny' and 'audit deny' rule modifiers. The 'deny' modifier
resulting in accesses being audited and the 'audit deny' modifier
resulting in accesses not being audited. (LP: #1226356)
* debian/patches/0072-lp1229393.patch: Fix cache location for .features
file, which was not being written to the proper location if the parameter
--cache-loc= is passed to apparmor_parser. This bug resulted in using the
.features file from /etc/apparmor.d/cache or always recompiling policy.
Patch thanks to John Johansen. (LP: #1229393)
* debian/patches/0073-lp1208988.patch: Update AppArmor file rules of UNIX
domain sockets to include read and write permissions. Both permissions are
required when a process connects to a UNIX domain socket. Also include new
tests for mediation of UNIX domain sockets. Thanks to Jamie Strandboge for
helping with the policy updates and testing. (LP: #1208988)
* debian/patches/0075-lp1211380.patch: Adjust the audio abstraction to only
grant access to specific pulseaudio files in the pulse runtime directory
to remove access to potentially dangerous files (LP: #1211380)
[ Jamie Strandboge ]
* debian/patches/0074-lp1228882.patch: typo in ubuntu-browsers.d/multimedia
(LP: #1228882)
* 0076_sanitized_helper_dbus_access.patch: allow applications run under
sanitized_helper to connect to DBus
-- Tyler Hicks <email address hidden> Fri, 04 Oct 2013 17:29:52 -0700
-
apparmor (2.8.0-0ubuntu29) saucy; urgency=low
* Add 0070-etc-writable.patch: Allow reading time configuration from
/etc/writable, as we have it on the phone. (LP: #1227520)
-- Martin Pitt <email address hidden> Tue, 01 Oct 2013 09:55:15 +0200
-
apparmor (2.8.0-0ubuntu28) saucy; urgency=low
[ Tyler Hicks ]
* Move the aa-exec man page out of apparmor-utils into apparmor, since
aa-exec is now in apparmor
- debian/control: adjust Breaks/Replaces to use apparmor-utils
(<< 2.8.0-0ubuntu28)
- debian/apparmor.manpages: install the aa-exec man page
- debian/apparmor-utils.manpages: don't install the aa-exec man page
* debian/patches/0065-lp1220861.patch: Always NUL-terminate confinement
context strings returned from libapparmor (LP: #1220861)
* debian/patches/0066-lp1196880.patch: Don't assign mode pointer in
aa_getprocattr() if caller passed in NULL (LP: #1196880)
* debian/patches/0067-libapparmor-mode-strings-are-not-to-be-freed.patch:
Update man page and code comments to make it clear that freeing the *con
string returned from libapparmor's getcon functions also frees the *mode
string
* debian/patches/0068-libapparmor-mention-dbus-method-in-getcon-man.patch:
Document the D-Bus method, in the aa_getcon man page, that returns the
AppArmor task confinement string of a D-Bus connection
[ Jamie Strandboge ]
* debian/patches/0069-p11kit-abstraction.patch: p11-kit needs access to
/usr/share/p11-kit/modules
-- Jamie Strandboge <email address hidden> Tue, 10 Sep 2013 12:06:06 -0500
-
apparmor (2.8.0-0ubuntu27) saucy; urgency=low
* debian/apport/source_apparmor.py: AppArmor logs DBus messages to syslog,
adjust apport hook to also search there for denials
-- Jamie Strandboge <email address hidden> Tue, 03 Sep 2013 10:25:45 -0500
-
apparmor (2.8.0-0ubuntu26) saucy; urgency=low
* debian/patches/0064-lp1218099.patch: add support for variable expansion in
dbus rules (LP: #1218099)
-- Jamie Strandboge <email address hidden> Thu, 29 Aug 2013 16:28:36 -0500
-
apparmor (2.8.0-0ubuntu25) saucy; urgency=low
[ Tyler Hicks ]
* Add support for mediation of D-Bus messages and services. AppArmor D-Bus
rules are described in the apparmor.d(5) man page. dbus-daemon will use
libapparmor to perform queries against the AppArmor policies to determine
if a connection should be able to send messages to another connection, if
a connection should be able to receive messages from another connection,
and if a connection should be able to bind to a well-known name.
- 0042-Fix-mount-rule-preprocessor-output.patch,
0043-libapparmor-Safeguard-aa_getpeercon-buffer-reallocat.patch,
0044-libapparmor-fix-return-value-of-aa_getpeercon_raw.patch,
0045-libapparmor-Move-mode-parsing-into-separate-function.patch,
0046-libapparmor-Parse-mode-from-confinement-string-in-ge.patch,
0047-libapparmor-Make-aa_getpeercon_raw-similar-to-aa_get.patch,
0048-libapparmor-Update-aa_getcon-man-page-to-reflect-get.patch:
Backport parser and libapparmor pre-requisites for D-Bus mediation
- 0049-parser-Update-man-page-for-DBus-rules.patch: Update apparmor.d man
page
- 0050-parser-Add-support-for-DBus-rules.patch,
0051-parser-Regression-tests-for-DBus-rules.patch,
0052-parser-Binary-profile-equality-tests-for-DBus-rules.patch: Add
apparmor_parser support for D-Bus mediation rules
- 0053-libapparmor-Export-a-label-based-query-interface.patch,
debian/libapparmor1.symbols: Provide the libapparmor interface necessary
for trusted helpers to make security decisions based upon AppArmor
policy
- 0054-libaalogparse-Parse-dbus-daemon-audit-messages.patch,
0055-libaalogparse-Regression-tests-for-dbus-daemon-audit.patch: Allow
applications to parse denials, generated by dbus-daemon, using
libaalogparse and add a set of regression tests
- 0056-tests-Add-an-optional-final-check-to-checktestfg.patch,
0057-tests-Add-required-features-check.patch,
0058-tests-Add-regression-tests-for-dbus.patch: Add regression tests
which start their own dbus-daemon, load profiles containing D-Bus rules,
and confine simple D-Bus service and client applications
- 0059-dbus-rules-for-dbus-abstractions.patch: Add bus-specific, but
otherwise permissive, D-Bus rules to the dbus and dbus-session
abstractions. Confined applications that use D-Bus should already be
including these abstractions in their profiles so this should be a
seamless transition for those profiles.
* 0060-utils-make_clean_fixup.patch: Clean up the Python cache in the
AppArmor tests directory
* 0061-profiles-dnsmasq-needs-dbus-abstraction.patch: Dnsmasq uses the
system D-Bus when it is started with --enable-dbus, so its AppArmor
profile needs to include the system bus abstraction
* 0062-fix-clone-test-on-arm.patch: Fix compiler error when building
regression tests on ARM
* 0063-utils-ignore-unsupported-rules.patch: Utilities that use the
Immunix::AppArmor perl module, such as aa-logprof and aa-genprof, error
out when they encounter rules unsupported by the perl module. This patch
ignores unsupported rules.
[ Jamie Strandboge ]
* debian/control: don't have easyprof Depends on apparmor-easyprof-ubuntu
-- Tyler Hicks <email address hidden> Mon, 26 Aug 2013 15:32:12 -0700
-
apparmor (2.8.0-0ubuntu24) saucy; urgency=low
* 0040-libapparmor-support-pkg-config.patch: Make it easier for other
sources to build against libapparmor with pkg-config
- debian/control: Add pkg-config as a Build-Depends
- debian/libapparmor-dev.install: Install libapparmor pkg-config file
* 0041-parser-fix-flags.patch: Minimal fix for cache failures when the
feature file is larger than the feature buffer used for cache version
comparison
-- Tyler Hicks <email address hidden> Thu, 15 Aug 2013 16:34:53 -0700
-
apparmor (2.8.0-0ubuntu23) saucy; urgency=low
* debian/patches/0038-lp1200392.patch: allow mmap of fglrx dri libraries
(LP: #1200392)
* debian/patches/0039-fix-parser-cache-loc.patch: fix apparmor cache
tempfile location to use passed arg
* debian/lib/apparmor/functions: update to also load from
/var/lib/apparmor/profiles and write cache to /var/cache/apparmor
* debian/apparmor.dirs: create /var/cache/apparmor and
/var/lib/apparmor/profiles
-- Jamie Strandboge <email address hidden> Tue, 23 Jul 2013 21:36:40 -0500
-
apparmor (2.8.0-0ubuntu22) saucy; urgency=low
* Refresh easyprof
- drop 0034-easyprof-dont-add-vendor-dir.patch
- drop 0035-easyprof-update-manpage-for-sdk-base.patch
* debian/patches/0037-easyprof-sdk-pt2.patch: update easyprof for the
following:
- don't add vendor directory to self.templates and self.policy_groups
- utils/aa-easyprof: adjust error message for manifest read failure
- utils/aa-easyprof: adjust to use EnvironmentError on failed read of the
manifest
- utils/apparmor/easyprof.py: clean up set_template()
- utils/apparmor/easyprof.py: read_paths should use 'rk'
- utils/test/test-aa-easyprof.py: adjust tests for above
- utils/apparmor/easyprof.py
+ valid_path should verify os.path.normpath(path) == (path)
+ adjust valid_profile_name() to start with alpha-numeric and allow
Debian source package names and version, plus '_'
+ adjust tests for above
- update valid_variable() to check for valid_path if '/' is in the value
- adjust valid_path() to have a relative_ok flag (default to False)
- adjust valid_path() to verify path is same as normalized path
- add some valid_path() test cases
- adjust to always quote template vars in policy output
- add a couple tests that have spaces in the binary and template var
- update manifest JSON structure to use
m['security']['profiles']['profile_name'] instead of
m['security']['profile_name']
-- Jamie Strandboge <email address hidden> Sun, 07 Jul 2013 19:37:56 -0500
-
apparmor (2.8.0-0ubuntu21) saucy; urgency=low
* Apache 2.4 transition (LP: #1197617, Closes: 666808). Based on patch from
intrigeri
- debian/control:
+ Build-Depends on apache2-dev and dh-apache2 instead of
apache2-prefork-dev
+ adjust libapache2-mod-apparmor to not Depends on apache2.2-common
+ adjust libapache2-mod-apparmor to Pre-Depends: ${misc:Pre-Depends}
- create debian/libapache2-mod-apparmor.apache2
- debian/rules: adjust to use dh_apache2 --noenable
- debian/libapache2-mod-apparmor.maintscript: remove old prefork profile
- debian/libapache2-mod-apparmor.install: install new usr.sbin.apache2
profile
- debian/libapache2-mod-apparmor.{preinst,postinst,postrm}: update to use
usr.sbin.apache2
- debian/libapache2-mod-apparmor.postinst: remove the disable symlink for
old prefork profile
- debian/patches/0036-libapache2-mod-apparmor-profile-2.4.patch: update
mod_apparmor man page to mention loading mpm_prefork, add new
usr.sbin.apache2 profile and remove old prefork profile
* debian/rules: honor DEB_BUILD_OPTIONS=nocheck
apparmor (2.8.0-0ubuntu20) saucy; urgency=low
* remove debian/patches/0033-add-ubuntu-sdk-abstractions.patch. We will
for now ship policy groups instead of abstractions like this
* debian/apparmor.maintscript: rm_conffile on ubuntu-sdk-base
* debian/patches/0035-easyprof-update-manpage-for-sdk-base.patch: add
sdk-base as a typical policy group
-- Jamie Strandboge <email address hidden> Thu, 04 Jul 2013 10:20:20 -0500
-
apparmor (2.8.0-0ubuntu20) saucy; urgency=low
* remove debian/patches/0033-add-ubuntu-sdk-abstractions.patch. We will
for now ship policy groups instead of abstractions like this
* debian/apparmor.maintscript: rm_conffile on ubuntu-sdk-base
* debian/patches/0035-easyprof-update-manpage-for-sdk-base.patch: add
sdk-base as a typical policy group
-- Jamie Strandboge <email address hidden> Wed, 03 Jul 2013 17:29:57 -0500
-
apparmor (2.8.0-0ubuntu19.1) saucy; urgency=low
* Refresh easyprof
- drop 0034-easyprof-dont-add-vendor-dir.patch
* debian/patches/0037-easyprof-sdk-pt2.patch: update easyprof for the
following:
- don't add vendor directory to self.templates and self.policy_groups
- utils/aa-easyprof: adjust error message for manifest read failure
- utils/aa-easyprof: adjust to use EnvironmentError on failed read of the
manifest
- utils/apparmor/easyprof.py: clean up set_template()
- utils/apparmor/easyprof.py: read_paths should use 'rk'
- utils/test/test-aa-easyprof.py: adjust tests for above
- utils/apparmor/easyprof.py
+ valid_path should verify os.path.normpath(path) == (path)
+ adjust valid_profile_name() to start with alpha-numeric and allow
Debian source package names and version, plus '_'
+ adjust tests for above
- update valid_variable() to check for valid_path if '/' is in the value
- adjust valid_path() to have a relative_ok flag (default to False)
- adjust valid_path() to verify path is same as normalized path
- add some valid_path() test cases
- adjust to always quote template vars in policy output
- add a couple tests that have spaces in the binary and template var
- update manifest JSON structure to use
m['security']['profiles']['profile_name'] instead of
m['security']['profile_name']
* remove debian/patches/0033-add-ubuntu-sdk-abstractions.patch. We will
for now ship policy groups instead of abstractions like this
* debian/apparmor.maintscript: rm_conffile on ubuntu-sdk-base
-- Jamie Strandboge <email address hidden> Wed, 03 Jul 2013 17:29:57 -0500
-
apparmor (2.8.0-0ubuntu19) saucy; urgency=low
* debian/patches/0034-easyprof-dont-add-vendor-dir.patch: don't add vendor
directory to self.templates and self.policy_groups
* debian/patches/0030-easyprof-sdk.patch: mentioned patch has been forwarded
upstream
-- Jamie Strandboge <email address hidden> Tue, 02 Jul 2013 09:24:23 -0500
-
apparmor (2.8.0-0ubuntu18) saucy; urgency=low
* debian/patches/0030-easyprof-sdk.patch: refreshed for the following:
- man page updates
- add --output-format=json option
- add --verify-manifest
- add --policy-version and --policy-vendor which to better work with
vendor templates (ie, with apparmor-easyprof-ubuntu)
- restructed JSON format (should be final version now). This converts
abstractions and policy_groups to proper JSON lists and allows for
multiple profiles in the JSON file, keyed off of the profile name
- add --output-directory option as an alternative to stdout (particularly
useful when using multiple profiles in a JSON file)
- also remove ubuntu-sdk-base abstraction. This may move out but for now
put it in a different patch
- add verify_options() and some utility functions for input validation
- unconditionally quote profile name and binary
- remove Ubuntu-specific checks in verify_manifest and check profile_name
with binary harder
* debian/patches/0033-add-ubuntu-sdk-abstractions.patch: add ubuntu-sdk-base
abstraction
-- Jamie Strandboge <email address hidden> Mon, 01 Jul 2013 17:20:33 -0500
-
apparmor (2.8.0-0ubuntu17) saucy; urgency=low
* debian/patches/0032-lp1195362.patch: don't pull in unused perl modules
(LP: #1195362)
* debian/rules: use dh_perl -d with libapparmor-perl to Depends on perl-base
instead of perl
* debian/patches/0030-easyprof-sdk.patch: update to remove the ubuntu
specific templates and policy groups. These will be shipped in
apparmor-easyprof-ubuntu
* debian/control: have apparmor-easyprof Depends on apparmor-easyprof-ubuntu
-- Jamie Strandboge <email address hidden> Fri, 28 Jun 2013 12:01:06 -0500
-
apparmor (2.8.0-0ubuntu16) saucy; urgency=low
* debian/patches/0030-easyprof-sdk.patch: update to have
- /usr/share/icons/gnome/index.theme should have 'rk' added to qmlscene
policy group
- add ubuntu-sdk-html5 template
- add qmlscene-webview policygroup
* debian/patches/0031-move-poppler-cmap-to-fonts.patch: more than just
gnome applications access /usr/share/poppler/cMap/**
-- Jamie Strandboge <email address hidden> Tue, 25 Jun 2013 15:58:33 -0500
-
apparmor (2.8.0-0ubuntu15) saucy; urgency=low
* move aa-exec out of apparmor-utils into apparmor, since we want it in the
default install
- debian/control: adjust Breaks/Replaces to use apparmor-utils
<<2.8.0-0ubuntu15) and have apparmor Depends on libapparmor-perl
- debian/apparmor.install: install aa-exec
- debian/apparmor-utils.install: don't install aa-exec
-- Jamie Strandboge <email address hidden> Tue, 25 Jun 2013 11:48:25 -0500
-
apparmor (2.8.0-0ubuntu14) saucy-proposed; urgency=low
* debian/patches/0029-easyprof-update-for-aa-sandbox.patch: add aa-sandbox
utility to source, but don't install yet. This includes code refactoring
for easyprof, which is required for the next patch
* debian/patches/0030-easyprof-sdk.patch: add SDK support to easyprof (don't
include DBus includes yet)
* create apparmor-easyprof package
- adjust debian/control for new packages and Breaks/Replaces on
apparmor-utils 2.8.0-0ubuntu14
- create debian/apparmor-easyprof.install
- debian/apparmor-utils.install: don't install easyprof. python libraries
moved to easyprof for now since it is the only consumer
- debian/apparmor-utils.manpages: move easyprof manpage to
debian/apparmor-easyprof.manpages
- debian/rules: dh_python3 should also run on apparmor-easyprof
* debian/control: dh-apparmor should Depends on apparmor-easyprof
* debian/debhelper/dh_apparmor: update to support --manifest argument
-- Jamie Strandboge <email address hidden> Mon, 24 Jun 2013 09:49:44 -0500
-
apparmor (2.8.0-0ubuntu13) saucy-proposed; urgency=low
* 0021-webapps_abstraction.patch: update to allow 'w' access to
~/.local/share/unity-webapps/availableapps*.db and 'rk' access to
~/.config/libaccounts-glib/accounts.db (LP: #1169633)
-- Jamie Strandboge <email address hidden> Mon, 10 Jun 2013 10:49:46 -0500
-
apparmor (2.8.0-0ubuntu12) saucy; urgency=low
* 0027-add-gnome-keyring-to-strict.patch: add @{HOME}/.gnome2/keyrings/** to
abstractions/private-files-strict
* 0028-add-upstart-to-private.patch: deny writes to upstart user sessions
jobs in abstractions/private-files
-- Jamie Strandboge <email address hidden> Mon, 13 May 2013 13:04:54 -0500
-
apparmor (2.8.0-0ubuntu11) raring; urgency=low
* 0025-update-pulseaudio-paths.patch: update path for pulseaudio directory
and cookie files
* 0026-add-vm_overcommit_memory.patch: add read access to
@{PROC}/sys/vm/overcommit_memory
* update 0001-add-chromium-browser.patch:
- additional accesses required by newer chromium-browser. Patch based on
work by Simon Deziel (LP: #1154164)
- don't include abstractions already included via gnome abstraction
- allow access to dconf/gsettings, required now
-- Jamie Strandboge <email address hidden> Mon, 08 Apr 2013 14:57:14 -0500
