~apparmor-dev/apparmor/2.11 : changes

~apparmor-dev/apparmor/2.11 » Changes from revision 3684

From Revision 3684 to 3665

Rev	Summary	Authors	Tags	Date
3684	profiles: tunables/global - accept seven digit pids profiles: tunables/global - accept seven digit pids [Merge from trunk revision 3722] On 64bit systems, /proc/sys/kernel/pid_max can be set to PID_MAX_LIMIT, (2^22), which results in seven digit pids. Adjust the @{PID} variable in tunables/global to accept this. Acked-by: intrigeri <intrigeri@boum.org> Acked-by: Steve Beattie <steve@nxnw.org> Bug: https://bugs.launchpad.net/apparmor/+bug/1717714	Vincas Dargis		6 years ago
3683	Add python3.6 line to utils/logprof.conf Add python3.6 line to utils/logprof.conf This is a backport of trunk r3718 by intrigeri Acked-by: John Johansen <john.johansen@canonical.com> for 2.11 and 2.10 (on IRC)	Christian Boltz		6 years ago
3682	Allow reading /etc/netconfig in abstractions/nameservice Allow reading /etc/netconfig in abstractions/nameservice /etc/netconfig is required by the tirpc library which nscd and several other programs use. References: https://bugzilla.opensuse.org/show_bug.cgi?id=1062244 Acked-by: Seth Arnold <seth.arnold@canonical.com> for 2.9, 2.10, 2.11 and trunk	Christian Boltz		6 years ago
3681	bump release version to 2.11.1 bump release version to 2.11.1	John Johansen	apparmor_2.11.1	6 years ago
3680	libapparmor: fix swig test_apparmor.py for zero length ptrac... libapparmor: fix swig test_apparmor.py for zero length ptrace records Merge from trunk revision 3715 The added testcase for a ptrace target with an empty string (ptrace_garbage_lp1689667_1.in) was causing the swig python test script to fail. The generated python swig record for libapparmor ends up setting a number of fields to None or other values that indicate the value is unset, and the test script was checking if the value in the field didn't evaluate to False in a python 'if' test. Unfortunately, python evaluates the empty string '' as False in 'if' tests, resulting in the specific field that contained the empty string to be dropped from the returned record. This commit fixes that by special case checking for the empty string. Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: John Johansen <john.johansen@canonical.com>	Steve Beattie		6 years ago
3679	Fix af_unix downgrade of network rules Fix af_unix downgrade of network rules with unix rules we output a downgraded rule compatible with network rules so that policy will work on kernels that support network socket controls but not the extended af_unix rules however this is currently broken if the socket type is left unspecified (initialized to -1), resulting in denials for kernels that don't support the extended af_unix rules. cherry-pick: lp:apparmor r3700 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: timeout	John Johansen		6 years ago
3678	Fix save_profiles() for YaST Fix save_profiles() for YaST YaST has two issues in the "save changed profiles" dialog: - when using "save selected", the list of profiles doesn't get updated. Update q.options inside the loop to fix this. - the list of profiles is displayed as "["/usr/bin/foo", true]" instead of just "/usr/bin/foo". Use changed.keys() instead of changed to fix this. (text-mode aa-logprof doesn't change, it always displayed "/usr/bin/foo" and continues to do so.) References: https://bugzilla.opensuse.org/show_bug.cgi?id=1062667 part a) Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.11. Note that 2.11 needs a slightly different patch (whitespace diff).	Christian Boltz		6 years ago
3677	Allow /var/run/dovecot/login-master-notify* in dovecot imap-... Allow /var/run/dovecot/login-master-notify* in dovecot imap-login profiles Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.11, 2.10 and 2.9.	Christian Boltz		6 years ago
3676	abstractions/freedesktop.org: support /usr/local/application... abstractions/freedesktop.org: support /usr/local/applications; support subdirs of applications folder Merge request by Cameron Norman 2015-06-07 https://code.launchpad.net/~cameronnemo/apparmor/abstraction-fdo-applications-fixups/+merge/261336 Acked-by: Christian Boltz <apparmor@cboltz.de> for trunk, 2.11, 2.10 and 2.9	Christian Boltz		6 years ago
3675	Add network 'smc' keyword in NetworkRule and apparmor.d manp... Add network 'smc' keyword in NetworkRule and apparmor.d manpage 'smc' seems to be new in kernel 4.12. Note that the 2.10 apparmor.d manpage also misses the 'kcm' keyword, so the patch also adds it there. Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.11 and 2.10.	Christian Boltz		6 years ago
3674	Samba profile updates for ActiveDirectory / Kerberos Samba profile updates for ActiveDirectory / Kerberos The Samba package used by the INVIS server (based on openSUSE) needs some additional Samba permissions for the added ActiveDirectory / Kerberos support. As discussed with Seth, add /var/lib/sss/mc/initgroups read permissions to abstractions/nameservice instead of only to the smbd profile because it's probably needed by more than just Samba if someone uses sss. Acked-by: Seth Arnold <seth.arnold@canonical.com> for 2.9, 2.10, 2.11 and trunk.	Christian Boltz		6 years ago
3673	update some Postfix profiles update some Postfix profiles - change abstractions/postfix-common to allow /etc/postfix/*.db k - add several permissions to postfix/error, postfix/lmtp and postfix/pipe - remove superfluous abstractions/kerberosclient from all postfix profiles - it's included via abstractions/nameservice Acked-by: Seth Arnold <seth.arnold@canonical.com> for 2.9, 2.10, 2.11 and trunk	Christian Boltz		6 years ago
3672	libapparmor: fix ptrace regression test failure libapparmor: fix ptrace regression test failure Merge from trunk revision 3692 In http://bazaar.launchpad.net/~apparmor-dev/apparmor/master/revision/3659, a testcase was added that where the expected output file did not match the input source name, cause libapparmor's regression tests to fail: Output doesn't match expected data: --- ./test_multi/ptrace_no_denied_mask.out 2017-08-18 16:35:30.000000000 -0700 +++ ./test_multi/out/ptrace_no_denied_mask.out 2017-08-18 16:35:38.985863094 -0700 @@ -1,5 +1,5 @@ START -File: ptrace_1.in +File: ptrace_no_denied_mask.in Event type: AA_RECORD_DENIED Audit ID: 1495217772.047:4471 Operation: ptrace FAIL: ptrace_no_denied_mask This patch corrects the issue. Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: Seth Arnold <seth.arnold@canonical.com>	Steve Beattie		6 years ago
3671	user abstractions: fix for non-latin file/directory names user abstractions: fix for non-latin file/directory names Merge from trunk commit 3691 Merge from Vincas Dargis, approved by intrigeri Fix user-write and user-download abstractions for non-latin file names. Acked-by: Steve Beattie <steve@nxnw.org>	Steve Beattie		6 years ago
3670	traceroute profile: support TCP SYN for probes, quite net_ad... traceroute profile: support TCP SYN for probes, quite net_admin request Merge from trunk revision 3690 Merge from Vincas Dargis, approved by intrigeri. fix traceroute denies in tcp mode Acked-by: Steve Beattie <steve@nxnw.org>	Steve Beattie		6 years ago
3669	abstractions/gnome: allow reading GLib schemas. abstractions/gnome: allow reading GLib schemas. Merge from trunk revision 3687 Merge from intrigeri based on original work by Cameron Norman. Acked-by: Steve Beattie <steve@nxnw.org>	Steve Beattie		6 years ago
3668	wayland abstraction: allow wayland-cursor-shared-* wayland abstraction: allow wayland-cursor-shared-* Merge from trunk revision 3686 Merge from intrigeri. Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870807 Acked-by: Steve Beattie <steve@nxnw.org>	Steve Beattie		6 years ago
3667	Prevent 'wa' conflicts for file rules Prevent 'wa' conflicts for file rules get_file_perms() and propose_file_rules() happily collect all file permissions. This could lead to proposing 'wa' permissions in aa-logprof, which then errored out because of conflicting permissions. This patch adds a check to both functions that removes 'a' if 'w' is present, and extends the tests to check this. Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.11. Note: Both functions (including this bug) were introduced together with FileRule, so older releases are not affected.	Christian Boltz		6 years ago
3666	Carry over all autodep-generated rules in handle_children() Carry over all autodep-generated rules in handle_children() When creating a new child profile, handle_children() did only copy over include and path rules. While this was correct in the past, path rules got changed to FileRule in the meantime and were therefore lost. (In practise, this means the "$binary mr," rule wasn't added to the new child profile, causing a "superfluous" question in aa-logprof.) This patch changes handle_children() to carry over the complete new child profile instead of only cherry-picking include and path rules. Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.11. Older versions (with path as hasher) are not affected.	Christian Boltz		6 years ago
3665	update aa-status.pod for updated podchecker update aa-status.pod for updated podchecker Bug-Ubuntu: https://launchpad.net/bugs/1707614 Signed-Off-By: Jamie Strandboge <jamie@canonical.com> Acked-by: Christian Boltz <apparmor@cboltz.de>	Jamie Strandboge		6 years ago

Older »