[Touch-packages] [Bug 1993353] Re: Add posix message queue IPC mediation
This bug was fixed in the package apparmor - 2.13.3-7ubuntu5.2 --- apparmor (2.13.3-7ubuntu5.2) focal; urgency=medium * Add capability upstream patches to fix LP: #1964636 - u/cap1-Generate-CAPABILITIES-in-a-script-due-to-make-4.3.patch: move code that generates a list of capabilities to a script in common/ - u/cap2-parser-Move-to-a-pre-generated-cap_names.h.patch: use a pre-generated list of capabilities so that all capabilities are supported even when building against older kernels. - u/cap3-parser-cleanup-capability_table-generation-by-droppi.patch: drop sys_log static declaration because it's already in the generated list. - u/cap4-parser-unify-capability-name-handling.patch: drop internal hardcoded capability table. - u/cap5-parser-Makefile-use-LC_ALL-C-when-invoking-sed.patch: use LC_ALL=C when invoking sed. - u/cap6-parser-Add-warning-to-capability_table-about-the-nee.patch: add warning to capability_table about the need to update the Makefile. - u/cap7-Add-CAP_BPF-and-CAP_PERFMON-to-severity.db.patch: add support for cap_bpf and cap_perfmon - u/cap8-parser-Makefile-fix-generated-cap-comparison-against.patch: fix generated cap comparison against known list * Add upstream patches for abi support. LP: #1728130 - u/abi1-parser-feature-abi-setup-parser-to-intersect-policy-.patch: add the ability to intersect parser and kernel features in the parser. - u/abi2-parser-add-basic-support-for-feature-abis.patch: add support to specify a feature abi. - u/abi3-pin-abi-2.13.patch: add and pin a policy abi for 2.13 - u/abi4-parser-fix-abi-rule-and-pinned-feature-file-interact.patch: fix abi rule and pinned feature file interaction - apparmor.install: add 2.13 abi file to be installed in /etc/apparmor.d/abi/ * Add mqueue patches. LP: #1993353 - u/mqueue1-parser-add-parser-support-for-message-queue-mediatio.patch: add parser support for mqueue mediation - u/mqueue2-tests-add-posix-message-queue-regression-tests.patch: add posix mqueue regression tests - u/mqueue3-utils-add-message-queue-rules-parsing-in-python-tool.patch: add support in python tools to parse mqueue rules - u/mqueue4-parser-add-parser-simple-tests-for-mqueue-rules.patch: add parser simple tests for mqueue - u/mqueue5-parser-place-perm-on-name-as-well-as-name-label-comb.patch: add permissions on name and also on name + label - u/mqueue6-libapparmor-add-support-for-requested-and-denied-on-.patch: add parsing support for "denied" and "requested" from audit logs - u/mqueue7-libapparmor-add-support-for-class-in-logparsing.patch: add parsing support for "class" from audit logs - u/mqueue8-utils-add-logparser-support-for-mqueue.patch: add logparser support for mqueue rules - u/mqueue9-tests-add-sysv-message-queue-regression-tests.patch: add sysv mqueue regression tests - u/mqueue10-parser-enable-mqueue-rules-when-abi-is-not-set.patch: override pinned features for mqueue rules when abi is not set in policy. - debian/rules: create mqueue testcase empty files for libapparmor tests. * Closes LP: #1994146 -- Georgia Garcia Mon, 10 Oct 2022 17:52:45 -0300 ** Changed in: apparmor (Ubuntu Focal) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1993353 Title: Add posix message queue IPC mediation Status in apparmor package in Ubuntu: New Status in apparmor source package in Focal: Fix Released Status in apparmor source package in Jammy: Fix Released Bug description: [ Impact ] We need to add IPC mediation support in the userspace tools, starting with posix message queue. This would improve security and lower the attack surface for applications There is already a proposal upstream: https://gitlab.com/apparmor/apparmor/-/merge_requests/858 [ Test Plan ] In the merge request in the description there are several tests added. There are parser tests that can be run with "make -C parser check" in the project source tree. There are also tests for the python tools that can be run ith "make -C utils check" in the project source tree. There are also regression tests in tests/regression/apparmor. They run with the whole test suite when you run with "sudo make tests", but they can also be run individually with "sudo ./posix_mq.sh" [ Where problems could occur ] There could be problems related to Bug 1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from
[Touch-packages] [Bug 1993353] Re: Add posix message queue IPC mediation
Focal is in soft freeze atm, once that is lifted this should land -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1993353 Title: Add posix message queue IPC mediation Status in apparmor package in Ubuntu: New Status in apparmor source package in Focal: Fix Committed Status in apparmor source package in Jammy: Fix Released Bug description: [ Impact ] We need to add IPC mediation support in the userspace tools, starting with posix message queue. This would improve security and lower the attack surface for applications There is already a proposal upstream: https://gitlab.com/apparmor/apparmor/-/merge_requests/858 [ Test Plan ] In the merge request in the description there are several tests added. There are parser tests that can be run with "make -C parser check" in the project source tree. There are also tests for the python tools that can be run ith "make -C utils check" in the project source tree. There are also regression tests in tests/regression/apparmor. They run with the whole test suite when you run with "sudo make tests", but they can also be run individually with "sudo ./posix_mq.sh" [ Where problems could occur ] There could be problems related to Bug 1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from apparmor-3.0. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1993353/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1993353] Re: Add posix message queue IPC mediation
Is there something blocking the release for focal? Thanks -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1993353 Title: Add posix message queue IPC mediation Status in apparmor package in Ubuntu: New Status in apparmor source package in Focal: Fix Committed Status in apparmor source package in Jammy: Fix Released Bug description: [ Impact ] We need to add IPC mediation support in the userspace tools, starting with posix message queue. This would improve security and lower the attack surface for applications There is already a proposal upstream: https://gitlab.com/apparmor/apparmor/-/merge_requests/858 [ Test Plan ] In the merge request in the description there are several tests added. There are parser tests that can be run with "make -C parser check" in the project source tree. There are also tests for the python tools that can be run ith "make -C utils check" in the project source tree. There are also regression tests in tests/regression/apparmor. They run with the whole test suite when you run with "sudo make tests", but they can also be run individually with "sudo ./posix_mq.sh" [ Where problems could occur ] There could be problems related to Bug 1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from apparmor-3.0. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1993353/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1993353] Re: Add posix message queue IPC mediation
This bug was fixed in the package apparmor - 3.0.4-2ubuntu2.2 --- apparmor (3.0.4-2ubuntu2.2) jammy; urgency=medium * Add mqueue patches. LP: #1993353 - u/mqueue1-parser-add-parser-support-for-message-queue-mediatio.patch: add parser support for mqueue mediation - u/mqueue2-tests-add-posix-message-queue-regression-tests.patch: add posix mqueue regression tests - u/mqueue3-utils-add-message-queue-rules-parsing-in-python-tool.patch: add support in python tools to parse mqueue rules - u/mqueue4-parser-add-parser-simple-tests-for-mqueue-rules.patch: add parser simple tests for mqueue - u/mqueue5-parser-Add-a-set-of-debug-flags-that-can-be-passed-t.patch: add debug flags that can be passed to the kernel - u/mqueue6-parser-Set-the-DEBUG1-flag-on-profiles-that-use-mque.patch: set DEBUG1 on mqueue rules - u/mqueue7-parser-place-perm-on-name-as-well-as-name-label-comb.patch: add permissions on name and also on name + label - u/mqueue8-libapparmor-add-support-for-requested-and-denied-on-.patch: add parsing support for "denied" and "requested" from audit logs - u/mqueue9-libapparmor-add-support-for-class-in-logparsing.patch: add parsing support for "class" from audit logs - u/mqueue10-utils-add-logparser-support-for-mqueue.patch: add logparser support for mqueue rules - u/mqueue11-tests-add-sysv-message-queue-regression-tests.patch: add sysv mqueue regression tests - debian/rules: create mqueue testcase empty files for libapparmor tests. * Closes LP: #1994146 -- Georgia Garcia Wed, 19 Oct 2022 11:52:00 -0300 ** Changed in: apparmor (Ubuntu Jammy) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1993353 Title: Add posix message queue IPC mediation Status in apparmor package in Ubuntu: New Status in apparmor source package in Focal: Fix Committed Status in apparmor source package in Jammy: Fix Released Bug description: [ Impact ] We need to add IPC mediation support in the userspace tools, starting with posix message queue. This would improve security and lower the attack surface for applications There is already a proposal upstream: https://gitlab.com/apparmor/apparmor/-/merge_requests/858 [ Test Plan ] In the merge request in the description there are several tests added. There are parser tests that can be run with "make -C parser check" in the project source tree. There are also tests for the python tools that can be run ith "make -C utils check" in the project source tree. There are also regression tests in tests/regression/apparmor. They run with the whole test suite when you run with "sudo make tests", but they can also be run individually with "sudo ./posix_mq.sh" [ Where problems could occur ] There could be problems related to Bug 1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from apparmor-3.0. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1993353/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1993353] Re: Add posix message queue IPC mediation
Tests for jammy worked as expected. The systemd autopkgtest on s390x passed after the test was retriggered. ** Tags removed: verification-needed verification-needed-jammy ** Tags added: verification-done verification-done-jammy -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1993353 Title: Add posix message queue IPC mediation Status in apparmor package in Ubuntu: New Status in apparmor source package in Focal: Fix Committed Status in apparmor source package in Jammy: Fix Committed Bug description: [ Impact ] We need to add IPC mediation support in the userspace tools, starting with posix message queue. This would improve security and lower the attack surface for applications There is already a proposal upstream: https://gitlab.com/apparmor/apparmor/-/merge_requests/858 [ Test Plan ] In the merge request in the description there are several tests added. There are parser tests that can be run with "make -C parser check" in the project source tree. There are also tests for the python tools that can be run ith "make -C utils check" in the project source tree. There are also regression tests in tests/regression/apparmor. They run with the whole test suite when you run with "sudo make tests", but they can also be run individually with "sudo ./posix_mq.sh" [ Where problems could occur ] There could be problems related to Bug 1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from apparmor-3.0. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1993353/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1993353] Re: Add posix message queue IPC mediation
### VERIFICATION DONE FOCAL ### * These steps were copied from https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1728130 as they are testing the same components, the setup is similar. * sudo add-apt-repository ppa:apparmor-dev/mqueue-dev sudo apt update # exchange keypair ssh scp linux-* ubuntu@x.x.x.x:~ sudo dpkg -i linux* sudo apt --fix-broken install # edit /etc/default/grub GRUB_DEFAULT='Advanced options for Ubuntu>Ubuntu, with Linux 5.4.0-131-generic' sudo update-grub restart/reboot machine sudo apt-get upgrade apparmor # go find menu entry and update grub /boot/boot.cfg # menuentry 'Ubuntu, with Linux 5.4.0-131-generic' # execute command GRUB_DEFAULT='Advanced options for Ubuntu>Ubuntu, with Linux 5.4.0-131-generic' # should output supports mqueue sudo apt install ubuntu-dev-tools -y pull-ppa-source --ppa georgiag/mqueue-sru apparmor focal sudo apt-get install autoconf libtool -y cd ./libraries/libapparmor/ ./autogen.sh export PYTHONPATH=/tmp/apparmor-2.13.3/libraries/libapparmor/swig/python export PYTHON=/usr/bin/python3 export PYTHON_VERSION=3 export PYTHON_VERSIONS=python3 export USE_SYSTEM=1 make ./configure sudo apt-get install flex dejagnu make sudo make check sudo make install cd binutils make make check make install cd ./libraries/libapparmor sh ./autogen.sh sh ./configure make make check make install cd parser $ make # depends on libapparmor having been built first $ make check # run unit tests cd /tests/regession/apparmor/ sudo make tests # from the main directory make -C parser check # all unit tests pass from the parser. Ran 66 tests in 44.800s PASS Generated 24964 xtransition interaction tests Generated 45132 dbus tests simple.pl .. ok All tests successful. There are deprecation warnings, but those can be ignored. ### VERIFICATION DONE FOCAL ### -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1993353 Title: Add posix message queue IPC mediation Status in apparmor package in Ubuntu: New Status in apparmor source package in Focal: Fix Committed Status in apparmor source package in Jammy: Fix Committed Bug description: [ Impact ] We need to add IPC mediation support in the userspace tools, starting with posix message queue. This would improve security and lower the attack surface for applications There is already a proposal upstream: https://gitlab.com/apparmor/apparmor/-/merge_requests/858 [ Test Plan ] In the merge request in the description there are several tests added. There are parser tests that can be run with "make -C parser check" in the project source tree. There are also tests for the python tools that can be run ith "make -C utils check" in the project source tree. There are also regression tests in tests/regression/apparmor. They run with the whole test suite when you run with "sudo make tests", but they can also be run individually with "sudo ./posix_mq.sh" [ Where problems could occur ] There could be problems related to Bug 1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from apparmor-3.0. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1993353/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1993353] Re: Add posix message queue IPC mediation
** Tags removed: verification-needed-focal ** Tags added: verification-done-focal -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1993353 Title: Add posix message queue IPC mediation Status in apparmor package in Ubuntu: New Status in apparmor source package in Focal: Fix Committed Status in apparmor source package in Jammy: Fix Committed Bug description: [ Impact ] We need to add IPC mediation support in the userspace tools, starting with posix message queue. This would improve security and lower the attack surface for applications There is already a proposal upstream: https://gitlab.com/apparmor/apparmor/-/merge_requests/858 [ Test Plan ] In the merge request in the description there are several tests added. There are parser tests that can be run with "make -C parser check" in the project source tree. There are also tests for the python tools that can be run ith "make -C utils check" in the project source tree. There are also regression tests in tests/regression/apparmor. They run with the whole test suite when you run with "sudo make tests", but they can also be run individually with "sudo ./posix_mq.sh" [ Where problems could occur ] There could be problems related to Bug 1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from apparmor-3.0. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1993353/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1993353] Re: Add posix message queue IPC mediation
Hello Georgia, or anyone else affected, Accepted apparmor into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/apparmor/2.13.3-7ubuntu5.2 in a few hours, and then in the -proposed repository. Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed- focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification- failed-focal. In either case, without details of your testing we will not be able to proceed. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping! N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days. ** Changed in: apparmor (Ubuntu Focal) Status: New => Fix Committed ** Tags added: verification-needed-focal -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1993353 Title: Add posix message queue IPC mediation Status in apparmor package in Ubuntu: New Status in apparmor source package in Focal: Fix Committed Status in apparmor source package in Jammy: Fix Committed Bug description: [ Impact ] We need to add IPC mediation support in the userspace tools, starting with posix message queue. This would improve security and lower the attack surface for applications There is already a proposal upstream: https://gitlab.com/apparmor/apparmor/-/merge_requests/858 [ Test Plan ] In the merge request in the description there are several tests added. There are parser tests that can be run with "make -C parser check" in the project source tree. There are also tests for the python tools that can be run ith "make -C utils check" in the project source tree. There are also regression tests in tests/regression/apparmor. They run with the whole test suite when you run with "sudo make tests", but they can also be run individually with "sudo ./posix_mq.sh" [ Where problems could occur ] There could be problems related to Bug 1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from apparmor-3.0. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1993353/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1993353] Re: Add posix message queue IPC mediation
Hello Georgia, or anyone else affected, Accepted apparmor into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/apparmor/3.0.4-2ubuntu2.2 in a few hours, and then in the -proposed repository. Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed- jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification- failed-jammy. In either case, without details of your testing we will not be able to proceed. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping! N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days. ** Changed in: apparmor (Ubuntu Jammy) Status: New => Fix Committed ** Tags added: verification-needed verification-needed-jammy -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1993353 Title: Add posix message queue IPC mediation Status in apparmor package in Ubuntu: New Status in apparmor source package in Jammy: Fix Committed Bug description: [ Impact ] We need to add IPC mediation support in the userspace tools, starting with posix message queue. This would improve security and lower the attack surface for applications There is already a proposal upstream: https://gitlab.com/apparmor/apparmor/-/merge_requests/858 [ Test Plan ] In the merge request in the description there are several tests added. There are parser tests that can be run with "make -C parser check" in the project source tree. There are also tests for the python tools that can be run ith "make -C utils check" in the project source tree. There are also regression tests in tests/regression/apparmor. They run with the whole test suite when you run with "sudo make tests", but they can also be run individually with "sudo ./posix_mq.sh" [ Where problems could occur ] There could be problems related to Bug 1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from apparmor-3.0. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1993353/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1993353] Re: Add posix message queue IPC mediation
** Description changed: [ Impact ] We need to add IPC mediation support in the userspace tools, starting with posix message queue. This would improve security and lower the attack surface for applications - There is already a proposal upstream: + There is already a proposal upstream: https://gitlab.com/apparmor/apparmor/-/merge_requests/858 [ Test Plan ] In the merge request in the description there are several tests added. There are parser tests that can be run with "make -C parser check" in the project source tree. There are also tests for the python tools that can be run ith "make -C utils check" in the project source tree. There are also regression tests in tests/regression/apparmor. They run with the whole test suite when you run with "sudo make tests", but they can also be run individually with "sudo ./posix_mq.sh" [ Where problems could occur ] - There could be problems related to #1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from + There could be problems related to Bug 1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from apparmor-3.0. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1993353 Title: Add posix message queue IPC mediation Status in apparmor package in Ubuntu: New Bug description: [ Impact ] We need to add IPC mediation support in the userspace tools, starting with posix message queue. This would improve security and lower the attack surface for applications There is already a proposal upstream: https://gitlab.com/apparmor/apparmor/-/merge_requests/858 [ Test Plan ] In the merge request in the description there are several tests added. There are parser tests that can be run with "make -C parser check" in the project source tree. There are also tests for the python tools that can be run ith "make -C utils check" in the project source tree. There are also regression tests in tests/regression/apparmor. They run with the whole test suite when you run with "sudo make tests", but they can also be run individually with "sudo ./posix_mq.sh" [ Where problems could occur ] There could be problems related to Bug 1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from apparmor-3.0. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1993353/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
