~intrigeri/apparmor/apache2-attach_disconnected

From Revision 3710 to 3691

expand all

collapse all

Rev		Summary	Authors	Date	Diff	Files
3710		apache2: use attach_disconnected apache2: use attach_disconnected Otherwise we fail with:    apparmor="ALLOWED" operation="file_mmap" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/apache2" name="" pid=13777 comm="apache2" requested_mask="rw" denied_mask="rw" fsuid=0 ouid=0 Patch by Guido Günther <agx@sigxcpu.org>.	intrigeri at boum	6 years ago
3709		Add the LSS and container con presentations for the last few... Add the LSS and container con presentations for the last few years Signed-off-by: John Johansen <john.johansen@canonical.com>	John Johansen	6 years ago
3708		Description: allow access to stub resolver configuration Description: allow access to stub resolver configuration Signed-Off-By: Jamie Strandboge <jamie@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>	Jamie Strandboge	6 years ago
3707		Add the patches for 4.13 and 4.14. These are based on securi... Add the patches for 4.13 and 4.14. These are based on security-next for 4.14 The old out of tree patchseries has been completely dropped. v4.13 has most of the newer apparmor 3.x code in it. v4.14 has the rest except the af_unix mediation which is included as the last patch	John Johansen	6 years ago
3706		abstractions/freedesktop.org: support /usr/local/application... abstractions/freedesktop.org: support /usr/local/applications; support subdirs of applications folder Merge request by Cameron Norman 2015-06-07 https://code.launchpad.net/~cameronnemo/apparmor/abstraction-fdo-applications-fixups/+merge/261336 Acked-by: Christian Boltz <apparmor@cboltz.de> for trunk, 2.11, 2.10 and 2.9	Christian Boltz	6 years ago
3705		Document the use of the features_X and requires() functions Document the use of the features_X and requires() functions Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Tyler Hicks <tyhicks@canonical.com>	John Johansen	6 years ago
3704		regression_test: Clarify message about skipping pivot root t... regression_test: Clarify message about skipping pivot root transitions Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Christian Boltz <apparmor@cboltz.de>	John Johansen	6 years ago
3703		regression tests: fix long path failure when path_max can no... regression tests: fix long path failure when path_max can not be written Not all kernels support writing the path_max kernel parameter after boot. Detect if it can be written and run the long_path tests only if it can be. Signed-off-by: Seth Forshee <seth.forshee@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>	John Johansen	6 years ago
3702		regression test: update query label tests to reflect, fixed ... regression test: update query label tests to reflect, fixed xpass cases newer versions of apparmor that support multi-transaction have this xpass case fixed Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>	John Johansen	6 years ago
3701		regression test: conditionaly run pivot_root domain, transit... regression test: conditionaly run pivot_root domain, transitions Update the tests to test whether the kernel and parser support domain transitions on pivot_root. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>	John Johansen	6 years ago
3700		with unix rules we output a downgraded rule compatible with ... with unix rules we output a downgraded rule compatible with network rules so that policy will work on kernels that support network socket controls but not the extended af_unix rules however this is currently broken if the socket type is left unspecified (initialized to -1), resulting in denials for kernels that don't support the extended af_unix rules. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: timeout	John Johansen	6 years ago
3699		Add network 'smc' keyword in NetworkRule and apparmor.d manp... Add network 'smc' keyword in NetworkRule and apparmor.d manpage 'smc' seems to be new in kernel 4.12. Note that the 2.10 apparmor.d manpage also misses the 'kcm' keyword, so the patch also adds it there. Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.11 and 2.10.	Christian Boltz	6 years ago
3698		Update parser/policy_cache.c to consistently use defines in Update parser/policy_cache.c to consistently use defines in valid_cached_file_version() Signed-Off-By: Jamie Strandboge <jamie@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>	Jamie Strandboge	6 years ago
3697		Samba profile updates for ActiveDirectory / Kerberos Samba profile updates for ActiveDirectory / Kerberos The Samba package used by the INVIS server (based on openSUSE) needs some additional Samba permissions for the added ActiveDirectory / Kerberos support. As discussed with Seth, add /var/lib/sss/mc/initgroups read permissions to abstractions/nameservice instead of only to the smbd profile because it's probably needed by more than just Samba if someone uses sss. Acked-by: Seth Arnold <seth.arnold@canonical.com> for 2.9, 2.10, 2.11 and trunk.	Christian Boltz	6 years ago
3696		Drop 'log' parameter from ReadLog Drop 'log' parameter from ReadLog This parameter is always [], so we can simplify the ReadLog __init__() parameters. Note that some tests handed over '' instead of []. This was a bug, but didn't matter because those tests only use a small portion of ReadLog. Acked-by: Seth Arnold <seth.arnold@canonical.com>	Christian Boltz	6 years ago
3695		Make aa.py 'log' non-global Make aa.py 'log' non-global 'log' is only used in do_logprof_pass, and reset to [] at the beginning of the function. Therefore it doesn't need to be a global variable. Also, do_logprof_pass() initializes log = [], which gets then handed over to ReadLog and overwritten by the read_log() call in the next line. To make clear that [] gets handed over to ReadLog, replace log with [] and drop the now superfluous initialization with []. Acked-by: Seth Arnold <seth.arnold@canonical.com>	Christian Boltz	6 years ago
3694		artiom suggested a man fix for postgresql's manpages artiom suggested a man fix for postgresql's manpages Signed-off-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: John Johansen <john.johansen@canonical.com>	Seth Arnold	6 years ago
3693		update some Postfix profiles update some Postfix profiles - change abstractions/postfix-common to allow /etc/postfix/*.db k - add several permissions to postfix/error, postfix/lmtp and postfix/pipe - remove superfluous abstractions/kerberosclient from all postfix   profiles - it's included via abstractions/nameservice Acked-by: Seth Arnold <seth.arnold@canonical.com> for 2.9, 2.10, 2.11 and trunk	Christian Boltz	6 years ago
3692		libapparmor: fix ptrace regression test failure libapparmor: fix ptrace regression test failure In http://bazaar.launchpad.net/~apparmor-dev/apparmor/master/revision/3659, a testcase was added that where the expected output file did not match the input source name, cause libapparmor's regression tests to fail:   Output doesn't match expected data:   --- ./test_multi/ptrace_no_denied_mask.out    2017-08-18 16:35:30.000000000 -0700   +++ ./test_multi/out/ptrace_no_denied_mask.out  2017-08-18 16:35:38.985863094 -0700   @@ -1,5 +1,5 @@    START   -File: ptrace_1.in   +File: ptrace_no_denied_mask.in    Event type: AA_RECORD_DENIED    Audit ID: 1495217772.047:4471    Operation: ptrace   FAIL: ptrace_no_denied_mask This patch corrects the issue. Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: Seth Arnold <seth.arnold@canonical.com>	Steve Beattie	6 years ago
3691		user abstractions: fix for non-latin file/directory names user abstractions: fix for non-latin file/directory names Merge from Vincas Dargis, approved by intrigeri Fix user-write and user-download abstractions for non-latin file names. Acked-by: Steve Beattie <steve@nxnw.org>	Steve Beattie	6 years ago

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1