Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-19 Thread Didier 'OdyX' Raboud
Le vendredi, 17 janvier 2014, 11.26:59 Didier '' Raboud a écrit : > Then the trigger can reload only the concerned profiles, and never do > it for all of them. (Using the dpkg hashsums instead of timestamps > would allow doing it only for _changed_ profiles too.) > > I'll try implementing somethin

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-17 Thread John Johansen
On 01/17/2014 04:20 PM, Seth Arnold wrote: > [I've trimmed the Cc:, it didn't seem worthwhile to keep all this in the > Debian BTS in addition to the usual mail list archives.] > > On Thu, Jan 16, 2014 at 04:15:35PM -0800, John Johansen wrote: >> It does not at the moment consider what is loaded i

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-17 Thread John Johansen
On 01/17/2014 02:26 AM, Didier 'OdyX' Raboud wrote: > Le jeudi, 16 janvier 2014, 14.49:06 Kees Cook a écrit : >> On Thu, Jan 16, 2014 at 07:37:04PM +0100, Didier 'OdyX' Raboud wrote: >>> man deb-trigggers contradicts you, in my reading; an 'activate >>> /etc/apparmor.d' triggers' file in apparmor w

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-17 Thread Seth Arnold
[I've trimmed the Cc:, it didn't seem worthwhile to keep all this in the Debian BTS in addition to the usual mail list archives.] On Thu, Jan 16, 2014 at 04:15:35PM -0800, John Johansen wrote: > It does not at the moment consider what is loaded into the kernel, but only > works off of the cache ti

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-17 Thread Didier 'OdyX' Raboud
Le jeudi, 16 janvier 2014, 14.49:06 Kees Cook a écrit : > On Thu, Jan 16, 2014 at 07:37:04PM +0100, Didier 'OdyX' Raboud wrote: > > man deb-trigggers contradicts you, in my reading; an 'activate > > /etc/apparmor.d' triggers' file in apparmor would make its action > > run _before_ cups (which would

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-17 Thread Jamie Strandboge
On 01/16/2014 06:23 PM, Seth Arnold wrote: ... > One of my work-items for 14.04 LTS is to rework the AppArmor policy > loading. \o/ ... > If dh_apparmor doesn't currently use --write-cache we should make it do > so, to allow the compilation to be saved for later. Same with the click > packagin

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-16 Thread John Johansen
On 01/16/2014 08:02 PM, Seth Arnold wrote: > On Thu, Jan 16, 2014 at 05:03:43PM -0800, John Johansen wrote: >> Well some of this will depend on which parser version you want to support. > > Argh. Leave it to me to forget that kernel, userspace, and surrounding > frameworks do not update in lockste

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-16 Thread Seth Arnold
On Thu, Jan 16, 2014 at 05:03:43PM -0800, John Johansen wrote: > Well some of this will depend on which parser version you want to support. Argh. Leave it to me to forget that kernel, userspace, and surrounding frameworks do not update in lockstep. Just how many dimensions does this matrix have, a

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-16 Thread John Johansen
On 01/16/2014 04:23 PM, Seth Arnold wrote: > On Thu, Jan 16, 2014 at 02:57:52PM -0800, John Johansen wrote: >> Is there a way for a trigger to notice which file was updated? >> That way we could use a trigger. >> >> If not another option that comes to mind is we could add a new flag to the >> parse

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-16 Thread Seth Arnold
On Thu, Jan 16, 2014 at 02:57:52PM -0800, John Johansen wrote: > Is there a way for a trigger to notice which file was updated? > That way we could use a trigger. > > If not another option that comes to mind is we could add a new flag to the > parser that would say reload only if the cache is out

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-16 Thread John Johansen
On 01/16/2014 03:03 PM, Kees Cook wrote: > On Thu, Jan 16, 2014 at 02:59:54PM -0800, John Johansen wrote: >> On 01/16/2014 02:57 PM, John Johansen wrote: >>> On 01/16/2014 02:49 PM, Kees Cook wrote: On Thu, Jan 16, 2014 at 07:37:04PM +0100, Didier 'OdyX' Raboud wrote: > Le jeudi, 16 janvie

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-16 Thread John Johansen
On 01/16/2014 03:03 PM, Kees Cook wrote: > On Thu, Jan 16, 2014 at 02:59:54PM -0800, John Johansen wrote: >> On 01/16/2014 02:57 PM, John Johansen wrote: >>> On 01/16/2014 02:49 PM, Kees Cook wrote: On Thu, Jan 16, 2014 at 07:37:04PM +0100, Didier 'OdyX' Raboud wrote: > Le jeudi, 16 janvie

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-16 Thread Kees Cook
On Thu, Jan 16, 2014 at 02:59:54PM -0800, John Johansen wrote: > On 01/16/2014 02:57 PM, John Johansen wrote: > > On 01/16/2014 02:49 PM, Kees Cook wrote: > >> On Thu, Jan 16, 2014 at 07:37:04PM +0100, Didier 'OdyX' Raboud wrote: > >>> Le jeudi, 16 janvier 2014 10.14:14, vous avez écrit : > On

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-16 Thread John Johansen
On 01/16/2014 02:57 PM, John Johansen wrote: > On 01/16/2014 02:49 PM, Kees Cook wrote: >> On Thu, Jan 16, 2014 at 07:37:04PM +0100, Didier 'OdyX' Raboud wrote: >>> Le jeudi, 16 janvier 2014 10.14:14, vous avez écrit : On Thu, Jan 16, 2014 at 11:11:22AM +0100, Didier 'OdyX' Raboud wrote: >

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-16 Thread John Johansen
On 01/16/2014 02:49 PM, Kees Cook wrote: > On Thu, Jan 16, 2014 at 07:37:04PM +0100, Didier 'OdyX' Raboud wrote: >> Le jeudi, 16 janvier 2014 10.14:14, vous avez écrit : >>> On Thu, Jan 16, 2014 at 11:11:22AM +0100, Didier 'OdyX' Raboud wrote: As far as I understand deb-triggers' manpage, this

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-16 Thread Kees Cook
On Thu, Jan 16, 2014 at 07:37:04PM +0100, Didier 'OdyX' Raboud wrote: > Le jeudi, 16 janvier 2014 10.14:14, vous avez écrit : > > On Thu, Jan 16, 2014 at 11:11:22AM +0100, Didier 'OdyX' Raboud wrote: > > > As far as I understand deb-triggers' manpage, this can be enforced > > > using 'activate /etc

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-16 Thread Didier 'OdyX' Raboud
Le jeudi, 16 janvier 2014 10.14:14, vous avez écrit : > On Thu, Jan 16, 2014 at 11:11:22AM +0100, Didier 'OdyX' Raboud wrote: > > As far as I understand deb-triggers' manpage, this can be enforced > > using 'activate /etc/apparmor.d/', which will then make the trigger > > run "at the start of the c

Re: [apparmor] Bug#735470: Fwd: Bug#735470: Could be implemented centrally with a dpkg trigger instead of requiring every package shipping an apparmor file to use dh_apparmor

2014-01-16 Thread Kees Cook
On Thu, Jan 16, 2014 at 11:11:22AM +0100, Didier 'OdyX' Raboud wrote: > Le mercredi, 15 janvier 2014, 11.14:07 Seth Arnold a écrit : > > On Wed, Jan 15, 2014 at 07:30:52PM +0100, intrigeri wrote: > > > From: Didier Raboud > > > apparmor could have an 'interest /etc/apparmor.d/' triggers file and >