Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-29 Thread Jim Fehlig
On 6/26/23 14:46, Christian Boltz wrote: [Please CC me, I'm not subscribed to the mailinglist] Hello, regarding the initial patch in this thread: The patch looks good and should go upstream IMHO. (Maybe except creating the dummy local/* files for AppArmor 3.x - see below for details.) A note

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-29 Thread Christian Boltz
Hello, Am Dienstag, 27. Juni 2023, 18:49:04 CEST schrieb Andrea Bolognani: > On Mon, Jun 26, 2023 at 10:46:40PM +0200, Christian Boltz wrote: [...] > > See above - IMHO the current upstream behaviour is not perfect, and > > will hopefully change to not creating the local/ files by default > > in

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-29 Thread Andrea Bolognani
On Thu, Jun 29, 2023 at 06:27:10AM -0700, Andrea Bolognani wrote: > On Wed, Jun 28, 2023 at 03:25:49PM -0600, Jim Fehlig wrote: > > On 6/23/23 07:11, Andrea Bolognani wrote: > > > The catch is that apparently the "include if exists" statement > > > doesn't work well before 3.0, and our support

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-29 Thread Andrea Bolognani
On Wed, Jun 28, 2023 at 03:25:49PM -0600, Jim Fehlig wrote: > On 6/23/23 07:11, Andrea Bolognani wrote: > > The catch is that apparently the "include if exists" statement > > doesn't work well before 3.0, and our support matrix will include > > distros that are still on AppArmor 2.x for a couple

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-28 Thread Jim Fehlig
On 6/28/23 15:25, Jim Fehlig wrote: On 6/23/23 07:11, Andrea Bolognani wrote: The catch is that apparently the "include if exists" statement doesn't work well before 3.0, and our support matrix will include distros that are still on AppArmor 2.x for a couple more years :( I'm working on a V2

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-28 Thread Jim Fehlig
On 6/23/23 07:11, Andrea Bolognani wrote: The catch is that apparently the "include if exists" statement doesn't work well before 3.0, and our support matrix will include distros that are still on AppArmor 2.x for a couple more years :( I'm working on a V2 of this patch and need help

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-27 Thread Jim Fehlig
On 6/27/23 11:28, Jim Fehlig wrote: On 6/27/23 10:49, Andrea Bolognani wrote: On Mon, Jun 26, 2023 at 10:46:40PM +0200, Christian Boltz wrote: Am Montag, 26. Juni 2023, 18:29:11 CEST schrieb Andrea Bolognani: On Mon, Jun 26, 2023 at 09:42:32AM -0600, Jim Fehlig wrote: Specifying which copy

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-27 Thread Jim Fehlig
On 6/27/23 10:49, Andrea Bolognani wrote: On Mon, Jun 26, 2023 at 10:46:40PM +0200, Christian Boltz wrote: Am Montag, 26. Juni 2023, 18:29:11 CEST schrieb Andrea Bolognani: On Mon, Jun 26, 2023 at 09:42:32AM -0600, Jim Fehlig wrote: Specifying which copy to use via a build time option is also

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-27 Thread Andrea Bolognani
On Mon, Jun 26, 2023 at 10:46:40PM +0200, Christian Boltz wrote: > Am Montag, 26. Juni 2023, 18:29:11 CEST schrieb Andrea Bolognani: > > On Mon, Jun 26, 2023 at 09:42:32AM -0600, Jim Fehlig wrote: > > > Specifying which copy to use via a build time option is also an > > > option :-). Does your

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-26 Thread Christian Boltz
[Please CC me, I'm not subscribed to the mailinglist] Hello, regarding the initial patch in this thread: The patch looks good and should go upstream IMHO. (Maybe except creating the dummy local/* files for AppArmor 3.x - see below for details.) A note about what you mentioned in the patch

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-26 Thread Andrea Bolognani
On Mon, Jun 26, 2023 at 09:42:32AM -0600, Jim Fehlig wrote: > On 6/26/23 03:52, Andrea Bolognani wrote: > > On Fri, Jun 23, 2023 at 11:31:04AM -0600, Jim Fehlig wrote: > > > On 6/23/23 07:11, Andrea Bolognani wrote: > > > > However, not only you've added a few such statements in your recent > > >

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-26 Thread Jim Fehlig
On 6/26/23 03:52, Andrea Bolognani wrote: On Fri, Jun 23, 2023 at 11:31:04AM -0600, Jim Fehlig wrote: On 6/23/23 07:11, Andrea Bolognani wrote: However, not only you've added a few such statements in your recent commit 9b743ee19053, but I myself have done the same a couple months back with

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-26 Thread Andrea Bolognani
On Fri, Jun 23, 2023 at 11:31:04AM -0600, Jim Fehlig wrote: > On 6/23/23 07:11, Andrea Bolognani wrote: > > However, not only you've added a few such statements in your recent > > commit 9b743ee19053, but I myself have done the same a couple months > > back with commit 7a39b04d683f, as part of

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-23 Thread Jim Fehlig
On 6/23/23 07:11, Andrea Bolognani wrote: On Thu, Jun 22, 2023 at 03:03:56PM -0600, Jim Fehlig wrote: On 6/22/23 11:08, Jim Fehlig wrote: On 6/22/23 08:50, Andrea Bolognani wrote: On Thu, Jun 08, 2023 at 10:37:43AM -0600, Jim Fehlig wrote: I assumed users would make VM customizations in the

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-23 Thread Andrea Bolognani
On Thu, Jun 22, 2023 at 03:03:56PM -0600, Jim Fehlig wrote: > On 6/22/23 11:08, Jim Fehlig wrote: > > On 6/22/23 08:50, Andrea Bolognani wrote: > > > On Thu, Jun 08, 2023 at 10:37:43AM -0600, Jim Fehlig wrote: > > > > I assumed users would make VM customizations in the per-VM profiles. > > > >

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-23 Thread Christian Ehrhardt
On Thu, Jun 22, 2023 at 7:11 PM Jim Fehlig wrote: > > On 6/22/23 08:50, Andrea Bolognani wrote: > > On Thu, Jun 08, 2023 at 10:37:43AM -0600, Jim Fehlig wrote: > >> On 6/8/23 08:11, Andrea Bolognani wrote: > >>> Note that the Debian package has included this patch[1] for many > >>> years, and

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-22 Thread Jim Fehlig
On 6/22/23 11:08, Jim Fehlig wrote: On 6/22/23 08:50, Andrea Bolognani wrote: On Thu, Jun 08, 2023 at 10:37:43AM -0600, Jim Fehlig wrote: On 6/8/23 08:11, Andrea Bolognani wrote: Note that the Debian package has included this patch[1] for many years, and while it partially overlaps with what

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-22 Thread Jim Fehlig
On 6/22/23 08:50, Andrea Bolognani wrote: On Thu, Jun 08, 2023 at 10:37:43AM -0600, Jim Fehlig wrote: On 6/8/23 08:11, Andrea Bolognani wrote: Note that the Debian package has included this patch[1] for many years, and while it partially overlaps with what you've added here, I see that local

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-22 Thread Andrea Bolognani
On Thu, Jun 08, 2023 at 10:37:43AM -0600, Jim Fehlig wrote: > On 6/8/23 08:11, Andrea Bolognani wrote: > > Note that the Debian package has included this patch[1] for many > > years, and while it partially overlaps with what you've added here, I > > see that local overrides for abstractions are

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-08 Thread Jim Fehlig
On 6/8/23 08:11, Andrea Bolognani wrote: On Tue, Jun 06, 2023 at 04:06:12PM -0600, Jim Fehlig wrote: Apparmor profiles in /etc/apparmor.d/ are config files that can and should be replaced on package upgrade, which introduces the potential to overwrite any local changes. Apparmor supports local

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-08 Thread Andrea Bolognani
On Tue, Jun 06, 2023 at 04:06:12PM -0600, Jim Fehlig wrote: > Apparmor profiles in /etc/apparmor.d/ are config files that can and should > be replaced on package upgrade, which introduces the potential to overwrite > any local changes. Apparmor supports local profile customizations via >

Re: [PATCH] apparmor: Add support for local profile customizations

2023-06-07 Thread Michal Prívozník
On 6/7/23 00:06, Jim Fehlig wrote: > Apparmor profiles in /etc/apparmor.d/ are config files that can and should > be replaced on package upgrade, which introduces the potential to overwrite > any local changes. Apparmor supports local profile customizations via > /etc/apparmor.d/local/ [1]. > >

[PATCH] apparmor: Add support for local profile customizations

2023-06-06 Thread Jim Fehlig
Apparmor profiles in /etc/apparmor.d/ are config files that can and should be replaced on package upgrade, which introduces the potential to overwrite any local changes. Apparmor supports local profile customizations via /etc/apparmor.d/local/ [1]. This change makes the support explicit by adding