Public bug reported: [ Impact ]
This SRU has several fixes: add unconfined profile for tuxedo-control-center (Bug 2046844) fix issues appointed by coverity fix samba profile (https://gitlab.com/apparmor/apparmor/-/issues/386) fix redefinition of _ which caused an issue with translation, failing aa-enforce (https://gitlab.com/apparmor/apparmor/-/issues/387) add mount test for CVE-2016-1585 (Bug 1597017 and Bug 2023814) add network inet mediation documentation to apparmor.d fix inet conditionals to only generate rules for inet family (https://gitlab.com/apparmor/apparmor/-/issues/384) add unconfined wike profile (Bug 2060810) add unconfined foliate profile (Bug 2060767) fix chromium_browser profile (https://gitlab.com/apparmor/apparmor/-/merge_requests/1208) add profiles for Transmission family of Bittorrent clients add profile for unshare utility (Bug 2046844) add profile for bwrap utility (Bug 2046844) fix unconfined firefox profile to support mozilla.org download (Bug 2056297) fix getattr and setattr perm mapping on mqueue rules (https://gitlab.com/apparmor/apparmor/-/issues/377 and https://gitlab.com/apparmor/apparmor/-/issues/378) fix inet tests (https://gitlab.com/apparmor/apparmor/-/issues/376) fix sshd profile (Bug 2060100) fix apparmor tools to allow mount destination globbing (https://gitlab.com/apparmor/apparmor/-/issues/381) fix firefox profile (https://gitlab.com/apparmor/apparmor/-/issues/380) move pam-related permissions to abstractions/authentication (https://bugzilla.opensuse.org/show_bug.cgi?id=1220032) [ Test Plan ] This has been extensively tested via the AppArmor regression test script in the QA Regression Testing repo: https://git.launchpad.net/qa-regression-testing/tree/scripts/test-apparmor.py This script runs various tests against the installed apparmor package, as well as building and running the various upstream regression and other test suites against this installed package: - https://gitlab.com/apparmor/apparmor/-/tree/master/tests/regression/apparmor?ref_type=heads - https://gitlab.com/apparmor/apparmor/-/tree/master/utils/test?ref_type=heads - https://gitlab.com/apparmor/apparmor/-/tree/master/parser/tst?ref_type=heads - https://gitlab.com/apparmor/apparmor/-/tree/master/libraries/libapparmor/testsuite?ref_type=heads The final test output was: ---------------------------------------------------------------------- Ran 62 tests in 1868.839s OK (skipped=4) [ Where problems could occur ] There could still be more applications affected by the restriction of the creation of unpriviliged user namespaces. They might require the creation of new unconfined profiles which could be mitigated in a later SRU. [ Other Info ] The SRU is available in: https://launchpad.net/~georgiag/+archive/ubuntu/apparmor-4.0.1 ** Affects: apparmor (Ubuntu) Importance: Undecided Status: New ** Description changed: [ Impact ] This SRU has several fixes: add unconfined profile for tuxedo-control-center (Bug 2046844) fix issues appointed by coverity fix samba profile (https://gitlab.com/apparmor/apparmor/-/issues/386) fix redefinition of _ which caused an issue with translation, failing aa-enforce (https://gitlab.com/apparmor/apparmor/-/issues/387) add mount test for CVE-2016-1585 (Bug 1597017 and Bug 2023814) add network inet mediation documentation to apparmor.d fix inet conditionals to only generate rules for inet family (https://gitlab.com/apparmor/apparmor/-/issues/384) add unconfined wike profile (Bug 2060810) add unconfined foliate profile (Bug 2060767) fix chromium_browser profile (https://gitlab.com/apparmor/apparmor/-/merge_requests/1208) add profiles for Transmission family of Bittorrent clients add profile for unshare utility (Bug 2046844) add profile for bwrap utility (Bug 2046844) fix unconfined firefox profile to support mozilla.org download (Bug 2056297) fix getattr and setattr perm mapping on mqueue rules (https://gitlab.com/apparmor/apparmor/-/issues/377 and https://gitlab.com/apparmor/apparmor/-/issues/378) fix inet tests (https://gitlab.com/apparmor/apparmor/-/issues/376) fix sshd profile (Bug 2060100) fix apparmor tools to allow mount destination globbing (https://gitlab.com/apparmor/apparmor/-/issues/381) fix firefox profile (https://gitlab.com/apparmor/apparmor/-/issues/380) move pam-related permissions to abstractions/authentication (https://bugzilla.opensuse.org/show_bug.cgi?id=1220032) [ Test Plan ] This has been extensively tested via the AppArmor regression test script in the QA Regression Testing repo: https://git.launchpad.net/qa-regression-testing/tree/scripts/test-apparmor.py This script runs various tests against the installed apparmor package, as well as building and running the various upstream regression and other test suites against this installed package: - - https://gitlab.com/apparmor/apparmor/-/tree/master/tests/regression/apparmor?ref_type=heads - - https://gitlab.com/apparmor/apparmor/-/tree/master/utils/test?ref_type=heads - - https://gitlab.com/apparmor/apparmor/-/tree/master/parser/tst?ref_type=heads - - https://gitlab.com/apparmor/apparmor/-/tree/master/libraries/libapparmor/testsuite?ref_type=heads + - https://gitlab.com/apparmor/apparmor/-/tree/master/tests/regression/apparmor?ref_type=heads + - https://gitlab.com/apparmor/apparmor/-/tree/master/utils/test?ref_type=heads + - https://gitlab.com/apparmor/apparmor/-/tree/master/parser/tst?ref_type=heads + - https://gitlab.com/apparmor/apparmor/-/tree/master/libraries/libapparmor/testsuite?ref_type=heads + + + The final test output was: + + ---------------------------------------------------------------------- + Ran 62 tests in 1868.839s + + OK (skipped=4) [ Where problems could occur ] There could still be more applications affected by the restriction of the creation of unpriviliged user namespaces. They might require the creation of new unconfined profiles which could be mitigated in a later SRU. [ Other Info ] - + The SRU is available in: https://launchpad.net/~georgiag/+archive/ubuntu/apparmor-4.0.1 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2064672 Title: [SRU] - fixes for apparmor on noble To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2064672/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
