File changes-since-2.10.1--r3326..3346.diff of Package apparmor

Overview Repositories Revisions Requests Users Attributes Meta

File changes-since-2.10.1--r3326..3346.diff of Package apparmor (Revision f1948781a251f9ebadb9dad48e069f7f)

Currently displaying revision f1948781a251f9ebadb9dad48e069f7f , Show latest

------------------------------------------------------------
revno: 3346
behebt den Fehler: https://launchpad.net/bugs/1538306
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Mon 2016-08-15 22:06:47 +0200
message:
  Fix aa-logprof "add hat" endless loop
  
  This turned out to be a simple case of misinterpreting the promptUser()
  result - it returns the answer and the selected option, and
  "surprisingly" something like
      ('CMD_ADDHAT', 0)
  never matched
      'CMD_ADDHAT'
  ;-)
  
  I also noticed that the new hat doesn't get initialized as
  profile_storage(), and that the changed profile doesn't get marked as
  changed. This is also fixed by this patch.
  
  
  References: https://bugs.launchpad.net/apparmor/+bug/1538306
  
  
  Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9
------------------------------------------------------------
revno: 3345
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Fri 2016-08-12 12:02:43 +0200
message:
  type_is_str(): make pyflakes3 happy
  
  pyflakes3 doesn't check sys.version and therefore complains about
  'unicode' being undefined.
  
  This patch defines unicode as alias of str to make pyflakes3 happy, and
  as a side effect, simplifies type_is_str().
  
  
  Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.10.
------------------------------------------------------------
revno: 3344
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Mon 2016-08-08 23:16:12 +0200
message:
  delete_duplicates(): don't modify self.rules while looping over it
  
  By calling self.delete() inside the delete_duplicates() loop, the
  self.rules list was modified. This resulted in some rules not being
  checked and therefore (some, not all) superfluous rules not being
  removed.
  
  This patch switches to a temporary variable to loop over, and rebuilds
  self.rules with the rules that are not superfluous.
  
  This also fixes some strange issues already marked with a "Huh?" comment
  in the tests.
  
  
  Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.10.
  
  Note that in 2.10 cleanprof_test.* doesn't contain a ptrace rule,
  therefore the cleanprof_test.out change doesn't make sense for 2.10.
------------------------------------------------------------
revno: 3343
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Wed 2016-08-03 21:53:06 +0200
message:
  winbindd profile: allow dac_override
  
  This is needed to delete kerberos ccache files, for details see
  https://bugzilla.opensuse.org/show_bug.cgi?id=990006#c5
  
  
  Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
  Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9.
------------------------------------------------------------
revno: 3342
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Sun 2016-07-31 17:15:42 +0200
message:
  logparser: store network-related params if an event looks like network
  
  Network events can come with an operation= that looks like a file event.
  Nevertheless, if the event has a typical network parameter (like
  net_protocol) set, make sure to store the network-related flags in ev.
  
  This fixes the test failure introduced in my last commit.
  
  
  Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for trunk, 2.10 and 2.9
------------------------------------------------------------
revno: 3341
behebt den Fehler: https://launchpad.net/bugs/1577051
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Sat 2016-07-30 00:44:18 +0200
message:
  logparser.py: ignore network events with 'send receive'
  
  We already ignore network events that look like file events (based on
  the operation keyword) if they have a request_mask of 'send' or
  'receive' to avoid aa-logprof crashes because of "unknown" permissions.
  It turned out that both can happen at once, so we should also ignore
  this case.
  
  Also add the now-ignored log event as test_multi testcase.
  
  
  References: https://bugs.launchpad.net/apparmor/+bug/1577051 #13
  
  
  Acked-by: Tyler Hicks <tyhicks@canonical.com> for trunk, 2.10 and 2.9.
------------------------------------------------------------
revno: 3340
committer: Seth Arnold <seth.arnold@canonical.com>
branch nick: 2.10
timestamp: Fri 2016-07-29 11:46:16 -0700
message:
  add ld.so.preload to <abstractions/base>, thanks to Uzair Shamim
------------------------------------------------------------
revno: 3339
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Tue 2016-07-26 21:13:49 +0200
message:
  Allow mr for /usr/lib*/ldb/*.so in samba abstractions
  
  This is needed for winbindd (since samba 4.4.x), but smbd could also need it.
  
  References: https://bugzilla.opensuse.org/show_bug.cgi?id=990006
  
  
  Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
------------------------------------------------------------
revno: 3338
committer: Seth Arnold <seth.arnold@canonical.com>
branch nick: 2.10
timestamp: Fri 2016-06-24 10:36:42 -0700
message:
  intrigeri@boum.org 2016-06-24 mod_apparmor manpage: fix "documenation" typo.
------------------------------------------------------------
revno: 3337
committer: Seth Arnold <seth.arnold@canonical.com>
branch nick: 2.10
timestamp: Wed 2016-06-22 15:15:42 -0700
message:
  From: Simon McVittie <simon.mcvittie@collabora.co.uk>
  Date: Tue, 21 Jun 2016 18:18:45 +0100
  Subject: abstractions/nameservice: also support ConnMan-managed resolv.conf
  
  Follow the same logic we already did for NetworkManager,
  resolvconf and systemd-resolved. The wonderful thing about
  standards is that there are so many to choose from.
  
  Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
  
  [modified by sarnold to fit the surroundings]
------------------------------------------------------------
revno: 3336
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Sun 2016-06-05 23:43:55 +0200
message:
  Add a note about still enforcing deny rules to aa-complain manpage
  
  This behaviour makes sense (for example to force the confined program to
  use a fallback path), but is probably surprising for users, so we should
  document it.
  
  References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=826218#37
  
  
  Acked-by: John Johansen <john.johansen@canonical.com> for trunk, 2.10 and 2.9
------------------------------------------------------------
revno: 3335
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Sun 2016-06-05 20:07:33 +0200
message:
  honor 'chown' file events in logparser.py
  
  Also add a testcase to libapparmor's log collection
  
  
  Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for trunk, 2.10 and 2.9
------------------------------------------------------------
revno: 3334
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Wed 2016-06-01 21:06:25 +0200
message:
  aa-genprof: ask about profiles in extra dir (again)
  
  Thanks to reading the wrong directory in read_inactive_profiles()
  (profile_dir instead of extra_profile_dir), aa-genprof never asked about
  using a profile from the extra_profile_dir.
  
  Sounds like an easy fix, right? ;-)
  
  After fixing this (last chunk), several other errors popped up, one
  after the other:
  - get_profile() missed a required parameter in a serialize_profile() call
  - when saving the profile, it was written to extra_profile_dir, not to
    profile_dir where it (as a now-active profile) should be. This is
    fixed by removing the filename from existing_profiles{} so that it can
    pick up the default name.
  - CMD_FINISHED (when asking if the extra profile should be used or a new
    one) behaved exactly like CMD_CREATE_PROFILE, but this is surprising
    for the user. Remove it to avoid confusion.
  - displaying the extra profile was only implemented in YaST mode
  - get_pager() returned None, not an actual pager. Since we have 'less'
    hardcoded at several places, also return it in get_pager()
  
  Finally, also remove CMD_FINISHED from the get_profile() test in
  test-translations.py.
  
  
  (test-translations.py is only in trunk, therefore this part of the patch
  is obviously trunk-only.)
  
  
  
  
  Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk
  Acked-by: John Johansen <john.johansen@canonical.com> for trunk + a 50% ACK for 2.10 and 2.9
  Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for trunk, 2.10 and 2.9
------------------------------------------------------------
revno: 3333
behebt die Fehler: https://launchpad.net/bugs/1577051 https://launchpad.net/bugs/1582374
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Mon 2016-05-23 23:32:23 +0200
message:
  Ignore file events with a request mask of 'send' or 'receive'
  
  Those events are actually network events, so ideally we should map them
  as such. Unfortunately this requires bigger changes, so here is a hotfix
  that ignores those events and thus avoids crashing aa-logprof.
  
  References: https://bugs.launchpad.net/apparmor/+bug/1577051
              https://bugs.launchpad.net/apparmor/+bug/1582374
  
  
  Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9
------------------------------------------------------------
revno: 3332
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Sun 2016-05-22 14:51:55 +0200
message:
  Document empty quotes ("") as empty value of a variable
  
  
  Acked-by: Seth Arnold <seth.arnold@canonical.com> for all branches where this makes sense :)
------------------------------------------------------------
revno: 3331
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Wed 2016-05-18 21:18:34 +0200
message:
  allow inet6 in ping profile
  
  The latest iputils merged ping and ping6 into a single binary that does
  both IPv4 and IPv6 pings (by default, it really does both).
  This means we need to allow network inet6 raw in the ping profile.
  
  References: https://bugzilla.opensuse.org/show_bug.cgi?id=980596
              (contains more details and example output)
  
  
  Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9
------------------------------------------------------------
revno: 3330
committer: Seth Arnold <seth.arnold@canonical.com>
branch nick: 2.10
timestamp: Wed 2016-05-11 17:23:22 -0700
message:
  dbus-session-strict: allow access to the user bus socket
  
  From: Simon McVittie <simon.mcvittie@collabora.co.uk>
  Date: Wed, 4 May 2016 13:48:36 +0100
  Subject: dbus-session-strict: allow access to the user bus socket
  
  If dbus is configured with --enable-user-bus (for example in the
  dbus-user-session package in Debian and its derivatives), and the user
  session is started with systemd, then the "dbus-daemon --session" will be
  started by "systemd --user" and listen on $XDG_RUNTIME_DIR/bus. Similarly,
  on systems where dbus-daemon has been replaced with kdbus, the
  bridge/proxy used to provide compatibility with the traditional D-Bus
  protocol listens on that same socket.
  
  In practice, $XDG_RUNTIME_DIR is /run/user/$uid on all systemd systems,
  where $uid represents the numeric uid. I have not used /{var/,}run here,
  because systemd does not support configurations where /var/run and /run
  are distinct; in practice, /var/run is a symbolic link.
  
  Based on a patch by Sjoerd Simons, which originally used the historical
  path /run/user/*/dbus/user_bus_socket. That path was popularized by the
  user-session-units git repository, but has never been used in a released
  version of dbus and should be considered unsupported.
  
  Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
------------------------------------------------------------
revno: 3329
committer: Seth Arnold <seth.arnold@canonical.com>
branch nick: 2.10
timestamp: Wed 2016-05-11 16:30:29 -0700
message:
  syscall_sysctl test: correctly skip if CONFIG_SYSCTL_SYSCALL=n
  
  From: Simon McVittie <simon.mcvittie@collabora.co.uk>
  Date: Wed, 11 May 2016 13:52:56 +0100
  Subject: syscall_sysctl test: correctly skip if CONFIG_SYSCTL_SYSCALL=n
  
  This test attempts to auto-skip the sysctl() part if that syscall
  was not compiled into the current kernel, via
  CONFIG_SYSCTL_SYSCALL=n. Unfortunately, this didn't actually work,
  for two reasons:
  
  * Because "${test} ro" wasn't in "&&", "||", a pipeline or an "if",
    and it had nonzero exit status, the trap on ERR was triggered,
    causing execution of the error_handler() shell function, which
    aborts the test with a failed status. The rules for ERR are the
    same as for "set -e", so we can circumvent it in the same ways.
  * Because sysctl_syscall.c prints its diagnostic message to stderr,
    but the $() operator only captures stdout, it never matched
    in the string comparison. This is easily solved by redirecting
    its stderr to stdout.
  
  Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
------------------------------------------------------------
revno: 3328
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Tue 2016-05-10 14:34:40 +0200
message:
  load variables in ask_the_questions()
  
  Variables can be used in several rule types (from the existing *Rule
  classes: change_profile, dbus, ptrace, signal). It seems nobody uses
  variables with those rules, otherwise we'd have received a bugreport ;-)
  
  I noticed this while working on FileRule, where usage of variables is
  more common. The file code in bzr (not using a *Rule class) already
  loads the variables, so old versions don't need changes for file rule
  handling.
  
  However, 2.10 already has ChangeProfileRule and therefore also needs
  this fix.
  
  
  Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.10.
------------------------------------------------------------
revno: 3327
behebt den Fehler: https://launchpad.net/bugs/1453300
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Thu 2016-05-05 12:02:11 +0200
message:
  accept hostname with dots
  
  Some people have the full hostname in their syslog messages, so
  libapparmor needs to accept hostnames that contain dots.
  
  
  References: https://bugs.launchpad.net/apparmor/+bug/1453300 comments
              #1 and #2 (the log samples reported by scrx in #apparmor)
  
  
  
  Acked-by: Seth Arnold <seth.arnold@canonical.com>
  Acked-by: John Johansen <john.johansen@canonical.com>
  for trunk, 2.10 and 2.9.
------------------------------------------------------------
revno: 3326
tags: apparmor_2.10.1
committer: John Johansen <john.johansen@canonical.com>
branch nick: 2.10
timestamp: Wed 2016-04-20 02:07:34 -0700
message:
  common/Version: prepare for 2.10.1 release
=== modified file 'changehat/mod_apparmor/mod_apparmor.pod'
--- changehat/mod_apparmor/mod_apparmor.pod	2014-09-15 18:30:47 +0000
+++ changehat/mod_apparmor/mod_apparmor.pod	2016-06-24 17:36:42 +0000
@@ -65,7 +65,7 @@
 
 AAHatName allows you to specify a hat to be used for a given Apache
 E<lt>DirectoryE<gt>, E<lt>DirectoryMatchE<gt>, E<lt>LocationE<gt> or
-E<lt>LocationMatchE<gt> directive (see the Apache documenation for more
+E<lt>LocationMatchE<gt> directive (see the Apache documentation for more
 details). Note that mod_apparmor behavior can become confused if
 E<lt>Directory*E<gt> and E<lt>Location*E<gt> directives are intermingled
 and it is recommended to use one type of directive. If the hat specified by

=== modified file 'libraries/libapparmor/src/scanner.l'
--- libraries/libapparmor/src/scanner.l	2015-06-02 08:00:29 +0000
+++ libraries/libapparmor/src/scanner.l	2016-05-05 10:02:11 +0000
@@ -178,7 +178,7 @@
 hhmmss			{digit}{2}{colon}{digit}{2}{colon}{digit}{2}
 timezone		({plus}|{minus}){digit}{2}{colon}{digit}{2}
 syslog_time 		{hhmmss}({period}{digits})?{timezone}?
-syslog_hostname		[[:alnum:]_-]+
+syslog_hostname		[[:alnum:]._-]+
 dmesg_timestamp		\[[[:digit:] ]{5,}\.[[:digit:]]{6,}\]
 
 %x single_quoted_string

=== added file 'libraries/libapparmor/testsuite/test_multi/file_chown.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/file_chown.in'
--- libraries/libapparmor/testsuite/test_multi/file_chown.in	1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/file_chown.in	2016-06-05 18:07:33 +0000
@@ -0,0 +1,1 @@
+type=AVC msg=audit(1465133533.431:728): apparmor="DENIED" operation="chown" profile="/usr/sbin/cupsd" name="/run/cups/certs/" pid=8515 comm="cupsd" requested_mask="w" denied_mask="w" fsuid=0 ouid=4

=== added file 'libraries/libapparmor/testsuite/test_multi/file_chown.out'
--- libraries/libapparmor/testsuite/test_multi/file_chown.out	1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/file_chown.out	2016-06-05 18:07:33 +0000
@@ -0,0 +1,15 @@
+START
+File: file_chown.in
+Event type: AA_RECORD_DENIED
+Audit ID: 1465133533.431:728
+Operation: chown
+Mask: w
+Denied Mask: w
+fsuid: 0
+ouid: 4
+Profile: /usr/sbin/cupsd
+Name: /run/cups/certs/
+Command: cupsd
+PID: 8515
+Epoch: 1465133533
+Audit subid: 728

=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_hostname_with_dot.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_hostname_with_dot.in'
--- libraries/libapparmor/testsuite/test_multi/syslog_hostname_with_dot.in	1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_hostname_with_dot.in	2016-05-05 10:02:11 +0000
@@ -0,0 +1,1 @@
+Sep 14 18:49:13 mfa-mia-74-app-rabbitmq-1.mia.ix.int kernel: [964718.247816] type=1400 audit(1442256553.643:40143): apparmor="ALLOWED" operation="open" profile="/opt/evoke/venv/bin/gunicorn" name="/opt/evoke/venv/lib/python2.7/warnings.pyc" pid=28943 comm="gunicorn" requested_mask="r" denied_mask="r" fsuid=1000 ouid=110

=== added file 'libraries/libapparmor/testsuite/test_multi/syslog_hostname_with_dot.out'
--- libraries/libapparmor/testsuite/test_multi/syslog_hostname_with_dot.out	1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/syslog_hostname_with_dot.out	2016-05-05 10:02:11 +0000
@@ -0,0 +1,15 @@
+START
+File: syslog_hostname_with_dot.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1442256553.643:40143
+Operation: open
+Mask: r
+Denied Mask: r
+fsuid: 1000
+ouid: 110
+Profile: /opt/evoke/venv/bin/gunicorn
+Name: /opt/evoke/venv/lib/python2.7/warnings.pyc
+Command: gunicorn
+PID: 28943
+Epoch: 1442256553
+Audit subid: 40143

=== added file 'libraries/libapparmor/testsuite/test_multi/testcase_network_send_receive.err'
=== added file 'libraries/libapparmor/testsuite/test_multi/testcase_network_send_receive.in'
--- libraries/libapparmor/testsuite/test_multi/testcase_network_send_receive.in	1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/testcase_network_send_receive.in	2016-07-29 22:44:18 +0000
@@ -0,0 +1,1 @@
+Jul 29 11:42:05 files kernel: [483212.877816] audit: type=1400 audit(1469785325.122:21021): apparmor="ALLOWED" operation="file_inherit" profile="/usr/bin/nginx-amplify-agent.py//null-/bin/dash" pid=18239 comm="sh" laddr=192.168.10.3 lport=50758 faddr=54.153.70.241 fport=443 family="inet" sock_type="stream" protocol=6 requested_mask="send receive" denied_mask="send receive"

=== added file 'libraries/libapparmor/testsuite/test_multi/testcase_network_send_receive.out'
--- libraries/libapparmor/testsuite/test_multi/testcase_network_send_receive.out	1970-01-01 00:00:00 +0000
+++ libraries/libapparmor/testsuite/test_multi/testcase_network_send_receive.out	2016-07-29 22:44:18 +0000
@@ -0,0 +1,19 @@
+START
+File: testcase_network_send_receive.in
+Event type: AA_RECORD_ALLOWED
+Audit ID: 1469785325.122:21021
+Operation: file_inherit
+Mask: send receive
+Denied Mask: send receive
+Profile: /usr/bin/nginx-amplify-agent.py//null-/bin/dash
+Command: sh
+PID: 18239
+Network family: inet
+Socket type: stream
+Protocol: tcp
+Local addr: 192.168.10.3
+Foreign addr: 54.153.70.241
+Local port: 50758
+Foreign port: 443
+Epoch: 1469785325
+Audit subid: 21021

=== modified file 'parser/apparmor.d.pod'
--- parser/apparmor.d.pod	2016-02-12 20:43:42 +0000
+++ parser/apparmor.d.pod	2016-05-22 12:51:55 +0000
@@ -1234,7 +1234,8 @@
 
 The parser will automatically expand variables to include all values
 that they have been assigned; it is an error to reference a variable
-without setting at least one value.
+without setting at least one value. You can use empty quotes ("") to
+explicitly add an empty value.
 
 At the time of this writing, the following variables are defined in the
 provided AppArmor policy:

=== modified file 'profiles/apparmor.d/abstractions/base'
--- profiles/apparmor.d/abstractions/base	2015-08-23 13:20:20 +0000
+++ profiles/apparmor.d/abstractions/base	2016-07-29 18:46:16 +0000
@@ -47,6 +47,7 @@
   # ld.so.cache and ld are used to load shared libraries; they are best
   # available everywhere
   /etc/ld.so.cache               mr,
+  /etc/ld.so.preload             r,
   /lib{,32,64}/ld{,32,64}-*.so   mrix,
   /lib{,32,64}/**/ld{,32,64}-*.so     mrix,
   /lib/@{multiarch}/ld{,32,64}-*.so    mrix,

=== modified file 'profiles/apparmor.d/abstractions/dbus-session-strict'
--- profiles/apparmor.d/abstractions/dbus-session-strict	2014-09-03 20:11:05 +0000
+++ profiles/apparmor.d/abstractions/dbus-session-strict	2016-05-12 00:23:22 +0000
@@ -17,6 +17,9 @@
        type=stream
        peer=(addr="@/tmp/dbus-*"),
 
+  # dbus with systemd and --enable-user-session
+  owner /run/user/[0-9]*/bus rw,
+
   dbus send
        bus=session
        path=/org/freedesktop/DBus

=== modified file 'profiles/apparmor.d/abstractions/nameservice'
--- profiles/apparmor.d/abstractions/nameservice	2016-01-05 23:04:34 +0000
+++ profiles/apparmor.d/abstractions/nameservice	2016-06-22 22:15:42 +0000
@@ -33,14 +33,10 @@
   /var/lib/sss/pipes/nss  rw,
 
   /etc/resolv.conf        r,
-  # on systems using resolvconf, /etc/resolv.conf is a symlink to
-  # /{,var/}run/resolvconf/resolv.conf and a file sometimes referenced in
-  # /etc/resolvconf/run/resolv.conf
-  /{,var/}run/resolvconf/resolv.conf r,
+  # On systems where /etc/resolv.conf is managed programmatically, it is
+  # a symlink to /{,var/}run/(whatever program is managing it)/resolv.conf.
+  /{,var/}run/{resolvconf,NetworkManager,systemd/resolve,connman}/resolv.conf r,
   /etc/resolvconf/run/resolv.conf r,
-  # on systems using systemd's networkd, /etc/resolv.conf is a symlink to
-  # /run/systemd/resolve/resolv.conf
-  /{,var/}run/systemd/resolve/resolv.conf r,
 
   /etc/samba/lmhosts      r,
   /etc/services           r,

=== modified file 'profiles/apparmor.d/abstractions/samba'
--- profiles/apparmor.d/abstractions/samba	2015-05-18 23:25:26 +0000
+++ profiles/apparmor.d/abstractions/samba	2016-07-26 19:13:49 +0000
@@ -10,6 +10,7 @@
 # ------------------------------------------------------------------
 
   /etc/samba/* r,
+  /usr/lib*/ldb/*.so mr,
   /usr/share/samba/*.dat r,
   /usr/share/samba/codepages/{lowcase,upcase,valid}.dat r,
   /var/cache/samba/ w,

=== modified file 'profiles/apparmor.d/bin.ping'
--- profiles/apparmor.d/bin.ping	2015-10-20 21:12:35 +0000
+++ profiles/apparmor.d/bin.ping	2016-05-18 19:18:34 +0000
@@ -18,6 +18,7 @@
   capability net_raw,
   capability setuid,
   network inet raw,
+  network inet6 raw,
 
   /{,usr/}bin/ping mixr,
   /etc/modules.conf r,

=== modified file 'profiles/apparmor.d/usr.sbin.winbindd'
--- profiles/apparmor.d/usr.sbin.winbindd	2015-07-30 20:03:02 +0000
+++ profiles/apparmor.d/usr.sbin.winbindd	2016-08-03 19:53:06 +0000
@@ -7,6 +7,7 @@
 
   deny capability block_suspend,
 
+  capability dac_override,
   capability ipc_lock,
   capability setuid,

=== modified file 'tests/regression/apparmor/syscall_sysctl.sh'
--- tests/regression/apparmor/syscall_sysctl.sh	2014-03-20 18:23:10 +0000
+++ tests/regression/apparmor/syscall_sysctl.sh	2016-05-11 23:30:29 +0000
@@ -149,8 +149,7 @@
 # generally we want to encourage kernels to disable it, but if it's
 # enabled we want to test against it
 settest syscall_sysctl
-res=$(${test} ro)
-if [ $? -ne 0 -a $res == "FAIL: sysctl read failed - Function not implemented" ] ; then
+if ! res="$(${test} ro 2>&1)" && [ "$res" = "FAIL: sysctl read failed - Function not implemented" ] ; then
     echo "	WARNING: syscall sysctl not implemented, skipping tests ..."
 else
     test_syscall_sysctl

=== modified file 'utils/aa-complain.pod'
--- utils/aa-complain.pod	2014-09-15 18:30:47 +0000
+++ utils/aa-complain.pod	2016-06-05 21:43:55 +0000
@@ -41,6 +41,8 @@
 In this mode security policy is not enforced but rather access violations
 are logged to the system log.
 
+Note that 'deny' rules will be enforced even in complain mode.
+
 =head1 BUGS
 
 If you find any bugs, please report them at

=== modified file 'utils/aa-mergeprof'
--- utils/aa-mergeprof	2015-07-06 20:02:34 +0000
+++ utils/aa-mergeprof	2016-05-10 12:34:40 +0000
@@ -1,6 +1,7 @@
 #! /usr/bin/env python
 # ----------------------------------------------------------------------
 #    Copyright (C) 2013 Kshitij Gupta <kgupta8592@gmail.com>
+#    Copyright (C) 2014-2016 Christian Boltz <apparmor@cboltz.de>
 #
 #    This program is free software; you can redistribute it and/or
 #    modify it under the terms of version 2 of the GNU General Public
@@ -17,7 +18,7 @@
 import os
 
 import apparmor.aa
-from apparmor.aa import available_buttons, combine_name, delete_duplicates, is_known_rule, match_includes
+from apparmor.aa import available_buttons, combine_name, delete_duplicates, get_profile_filename, is_known_rule, match_includes
 import apparmor.aamode
 from apparmor.common import AppArmorException
 from apparmor.regex import re_match_include
@@ -283,6 +284,9 @@
         if not sev_db:
             sev_db = apparmor.severity.Severity(apparmor.aa.CONFDIR + '/severity.db', _('unknown'))
 
+        sev_db.unload_variables()
+        sev_db.load_variables(get_profile_filename(profile))
+
         for hat in sorted(other.aa[profile].keys()):
             #Add the includes from the other profile to the user profile
             done = False

=== modified file 'utils/apparmor/aa.py'
--- utils/apparmor/aa.py	2016-03-01 20:25:29 +0000
+++ utils/apparmor/aa.py	2016-08-15 20:06:47 +0000
@@ -1,6 +1,6 @@
 # ----------------------------------------------------------------------
 #    Copyright (C) 2013 Kshitij Gupta <kgupta8592@gmail.com>
-#    Copyright (C) 2014-2015 Christian Boltz <apparmor@cboltz.de>
+#    Copyright (C) 2014-2016 Christian Boltz <apparmor@cboltz.de>
 #
 #    This program is free software; you can redistribute it and/or
 #    modify it under the terms of version 2 of the GNU General Public
@@ -557,8 +557,11 @@
         inactive_profile[prof_name][prof_name].pop('filename')
         profile_hash[uname]['username'] = uname
         profile_hash[uname]['profile_type'] = 'INACTIVE_LOCAL'
-        profile_hash[uname]['profile'] = serialize_profile(inactive_profile[prof_name], prof_name)
+        profile_hash[uname]['profile'] = serialize_profile(inactive_profile[prof_name], prof_name, None)
         profile_hash[uname]['profile_data'] = inactive_profile
+
+        existing_profiles.pop(prof_name)  # remove profile filename from list to force storing in /etc/apparmor.d/ instead of extra_profile_dir
+
     # If no profiles in repo and no inactive profiles
     if not profile_hash.keys():
         return None
@@ -579,18 +582,13 @@
 
     q = aaui.PromptQuestion()
     q.headers = ['Profile', prof_name]
-    q.functions = ['CMD_VIEW_PROFILE', 'CMD_USE_PROFILE', 'CMD_CREATE_PROFILE',
-                      'CMD_ABORT', 'CMD_FINISHED']
+    q.functions = ['CMD_VIEW_PROFILE', 'CMD_USE_PROFILE', 'CMD_CREATE_PROFILE', 'CMD_ABORT']
     q.default = "CMD_VIEW_PROFILE"
     q.options = options
     q.selected = 0
 
     ans = ''
     while 'CMD_USE_PROFILE' not in ans and 'CMD_CREATE_PROFILE' not in ans:
-        if ans == 'CMD_FINISHED':
-            save_profiles()
-            return
-
         ans, arg = q.promptUser()
         p = profile_hash[options[arg]]
         q.selected = options.index(options[arg])
@@ -602,12 +600,13 @@
                                 'profile_type': p['profile_type']
                                 })
                 ypath, yarg = GetDataFromYast()
-            #else:
-            #    pager = get_pager()
-            #    proc = subprocess.Popen(pager, stdin=subprocess.PIPE)
+            else:
+                pager = get_pager()
+                proc = subprocess.Popen(pager, stdin=subprocess.PIPE)
             #    proc.communicate('Profile submitted by %s:\n\n%s\n\n' %
             #                     (options[arg], p['profile']))
-            #    proc.kill()
+                proc.communicate(p['profile'].encode())
+                proc.kill()
         elif ans == 'CMD_USE_PROFILE':
             if p['profile_type'] == 'INACTIVE_LOCAL':
                 profile_data = p['profile_data']
@@ -658,6 +657,7 @@
     if not profile_data:
         profile_data = create_new_profile(pname)
     file = get_profile_filename(pname)
+    profile_data[pname][pname]['filename'] = None  # will be stored in /etc/apparmor.d when saving, so it shouldn't carry the extra_profile_dir filename
     attach_profile_data(aa, profile_data)
     attach_profile_data(original_aa, profile_data)
     if os.path.isfile(profile_dir + '/tunables/global'):
@@ -1095,7 +1095,7 @@
 
                     seen_events += 1
 
-                    ans = q.promptUser()
+                    ans = q.promptUser()[0]
 
                     if ans == 'CMD_FINISHED':
                         save_profiles()
@@ -1105,7 +1105,9 @@
 
                 if ans == 'CMD_ADDHAT':
                     hat = uhat
+                    aa[profile][hat] = profile_storage(profile, hat, 'handle_children addhat')
                     aa[profile][hat]['flags'] = aa[profile][profile]['flags']
+                    changed[profile] = True
                 elif ans == 'CMD_USEDEFAULT':
                     hat = default_hat
                 elif ans == 'CMD_DENY':
@@ -1590,6 +1592,10 @@
                 UI_SelectUpdatedRepoProfile(profile, p)
 
             found += 1
+
+            sev_db.unload_variables()
+            sev_db.load_variables(get_profile_filename(profile))
+
             # Sorted list of hats with the profile name coming first
             hats = list(filter(lambda key: key != profile, sorted(log_dict[aamode][profile].keys())))
             if log_dict[aamode][profile].get(profile, False):
@@ -2305,7 +2311,7 @@
                 reload_base(profile_name)
 
 def get_pager():
-    pass
+    return 'less'
 
 def generate_diff(oldprofile, newprofile):
     oldtemp = tempfile.NamedTemporaryFile('w')
@@ -2504,7 +2510,7 @@
     except:
         fatal_error(_("Can't read AppArmor profiles in %s") % extra_profile_dir)
 
-    for file in os.listdir(profile_dir):
+    for file in os.listdir(extra_profile_dir):
         if os.path.isfile(extra_profile_dir + '/' + file):
             if is_skippable_file(file):
                 continue

=== modified file 'utils/apparmor/common.py'
--- utils/apparmor/common.py	2015-12-17 22:38:02 +0000
+++ utils/apparmor/common.py	2016-08-12 10:02:43 +0000
@@ -245,11 +245,12 @@
         return False
     return True
 
+if sys.version_info[0] > 2:
+    unicode = str  # python 3 dropped the unicode type. To keep type_is_str() simple (and pyflakes3 happy), re-create it as alias of str.
+
 def type_is_str(var):
     ''' returns True if the given variable is a str (or unicode string when using python 2)'''
-    if type(var) == str:
-        return True
-    elif sys.version_info[0] < 3 and type(var) == unicode:  # python 2 sometimes uses the 'unicode' type
+    if type(var) in [str, unicode]:  # python 2 sometimes uses the 'unicode' type
         return True
     else:
         return False

=== modified file 'utils/apparmor/logparser.py'
--- utils/apparmor/logparser.py	2016-02-10 18:09:57 +0000
+++ utils/apparmor/logparser.py	2016-07-31 15:15:42 +0000
@@ -133,7 +133,7 @@
         ev['denied_mask'] = event.denied_mask
         ev['request_mask'] = event.requested_mask
         ev['magic_token'] = event.magic_token
-        if ev['operation'] and self.op_type(ev['operation']) == 'net':
+        if ev['operation'] and (self.op_type(ev['operation']) == 'net' or event.net_protocol):
             ev['family'] = event.net_family
             ev['protocol'] = event.net_protocol
             ev['sock_type'] = event.net_sock_type
@@ -278,7 +278,7 @@
                 self.debug_logger.debug('parse_event_for_tree: dropped exec event in %s' % e['profile'])
 
         elif ( e['operation'].startswith('file_') or e['operation'].startswith('inode_') or
-            e['operation'] in ['open', 'truncate', 'mkdir', 'mknod', 'chmod', 'rename_src',
+            e['operation'] in ['open', 'truncate', 'mkdir', 'mknod', 'chmod', 'chown', 'rename_src',
                                 'rename_dest', 'unlink', 'rmdir', 'symlink_create', 'link',
                                 'sysctl', 'getattr', 'setattr', 'xattr'] ):
 
@@ -289,6 +289,13 @@
                 self.debug_logger.debug('UNHANDLED (missing request_mask): %s' % e)
                 return None
 
+            # sometimes network events come with an e['operation'] that matches the list of file operations
+            # see https://bugs.launchpad.net/apparmor/+bug/1577051 and https://bugs.launchpad.net/apparmor/+bug/1582374
+            # XXX these events are network events, so we should map them as such
+            if 'send' in e['request_mask'] or 'receive' in e['request_mask']:
+                self.debug_logger.debug('UNHANDLED (request_mask is send or receive): %s' % e)
+                return None
+
             # Map c (create) and d (delete) to w (logging is more detailed than the profile language)
             rmask = e['request_mask']
             rmask = rmask.replace('c', 'w')

=== modified file 'utils/apparmor/rule/__init__.py'
--- utils/apparmor/rule/__init__.py	2016-01-25 22:42:45 +0000
+++ utils/apparmor/rule/__init__.py	2016-08-08 21:16:12 +0000
@@ -312,10 +312,13 @@
 
         # delete rules that are covered by include files
         if include_rules:
-            for rule in self.rules:
-                if include_rules.is_covered(rule, True, True):
-                    self.delete(rule)
+            oldrules = self.rules
+            self.rules = []
+            for rule in oldrules:
+                if include_rules.is_covered(rule, True, False):
                     deleted += 1
+                else:
+                    self.rules.append(rule)
 
         # de-duplicate rules inside the profile
         deleted += self.delete_in_profile_duplicates()

=== modified file 'utils/test/test-capability.py'
--- utils/test/test-capability.py	2015-11-23 23:22:37 +0000
+++ utils/test/test-capability.py	2016-08-08 21:16:12 +0000
@@ -817,7 +817,6 @@
             inc.add(CapabilityRule.parse(rule))
 
         expected_raw = [
-            '  allow capability sys_admin,',  # XXX huh? should be deleted!
             '  deny capability chgrp, # example comment',
             '',
         ]
@@ -825,11 +824,9 @@
         expected_clean = [
             '  deny capability chgrp, # example comment',
             '',
-            '  allow capability sys_admin,',  # XXX huh? should be deleted!
-            '',
         ]
 
-        self.assertEqual(self.ruleset.delete_duplicates(inc), 1)
+        self.assertEqual(self.ruleset.delete_duplicates(inc), 2)
         self.assertEqual(expected_raw, self.ruleset.get_raw(1))
         self.assertEqual(expected_clean, self.ruleset.get_clean(1))

Places

File changes-since-2.10.1--r3326..3346.diff of Package apparmor (Revision f1948781a251f9ebadb9dad48e069f7f)

Places