File changes-since-2.10.1--r3347..3353.diff of Package apparmor

Overview Repositories Revisions Requests Users Attributes Meta

File changes-since-2.10.1--r3347..3353.diff of Package apparmor (Revision e88175e63b8a747477385f0a2a783937)

Currently displaying revision e88175e63b8a747477385f0a2a783937 , Show latest

------------------------------------------------------------
revno: 3353
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Thu 2016-10-13 20:29:59 +0200
message:
  syslog-ng profile: allow writing *.qf files
  
  These files are needed for disk-based buffering (added in syslog-ng 3.8).
  This was reported to me by Peter Czanik, one of the syslog-ng developers.
  
  Note: I'm not sure about adding @{CHROOT_BASE} to this rule, so for now
  I prefer not to do it - adding it later is easy, but finding out if it
  could be removed is hard ;-)
  
  
  Acked-by: John Johansen <john.johansen@canonical.com> for trunk, 2.10 and 2.9.
------------------------------------------------------------
revno: 3352
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Wed 2016-10-05 20:53:37 +0200
message:
  Add missing permissions to dovecot profiles
  
  - dovecot/auth: allow to read stats-user
  - dovecot/config: allow to read /usr/share/dovecot/**
  - dovecot/imap: allow to ix doveconf, read /etc/dovecot/ and
    /usr/share/dovecot/**
  
  These things were reported by Félix Sipma in Debian Bug#835826
  (with some help from sarnold on IRC)
  
  References: https://bugs.debian.org/835826
  
  
  Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
  
  
  
  Also allow reading ~/.dovecot.svbin (that's the default filename in the
  dovecot config) in dovecot/lmtp profile.
  (*.svbin files can probably also appear inside @{DOVECOT_MAILSTORE}, but
  that's already covered by the existing rules.)
  
  References: https://bugs.debian.org/835826 (again)
  
  
  Acked-by: John Johansen <john.johansen@canonical.com> for trunk, 2.10 and 2.9
------------------------------------------------------------
revno: 3351
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Mon 2016-10-03 21:02:15 +0200
message:
  Drop CMD_CONTINUE from ui.py (twice)
  
  The latest version of pyflakes (1.3.0 / python 3.5) complains that
  CMD_CONTINUE is defined twice in ui.py (with different texts).
  
  Funnily CMD_CONTINUE isn't used anywhere, so we can just drop both.
  
  
  
  Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9
------------------------------------------------------------
revno: 3350
behebt den Fehler: https://launchpad.net/bugs/1379874
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Sat 2016-10-01 20:25:51 +0200
message:
  [39/38] Ignore exec events for non-existing profiles
  
  The switch to FileRule made some bugs visible that survived unnoticed
  with hasher for years.
  
  If aa-logprof sees an exec event for a non-existing profile _and_ a
  profile file matching the expected profile filename exists in
  /etc/apparmor.d/, it asks for the exec mode nevertheless (instead of
  being silent). In the old code, this created a superfluous entry
  somewhere in the aa hasher, and caused the existing profile to be
  rewritten (without changes).
  
  However, with FileRule it causes a crash saying
  
        File ".../utils/apparmor/aa.py", line 1335, in handle_children
          aa[profile][hat]['file'].add(FileRule(exec_target, file_perm, exec_mode, rule_to_name, owner=False, log_event=True))
      AttributeError: 'collections.defaultdict' object has no attribute 'add'
  
  This patch makes sure exec events for unknown profiles get ignored.
  
  
  
  Reproducer:
  
      python3 aa-logprof -f <(echo 'type=AVC msg=audit(1407865079.883:215): apparmor="ALLOWED" operation="exec" profile="/sbin/klogd" name="/does/not/exist" pid=11832 comm="foo" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="/sbin/klogd//null-1"')
  
  This causes a crash without this patch because
  /etc/apparmor.d/sbin.klogd exists, but has
      profile klogd /{usr/,}sbin/klogd {
  
  
  
  References: https://bugs.launchpad.net/bugs/1379874
  
  
  
  Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9
  
  
  *** *** ***   backport
  *** *** ***   --fixes lp:1379874
------------------------------------------------------------
revno: 3349
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Fri 2016-09-30 00:08:08 +0200
message:
  Allow both paths in traceroute profile
  
  In 2011 (r1803), the traceroute profile was changed to also match
  /usr/bin/traceroute.db:
      /usr/{sbin/traceroute,bin/traceroute.db} {
  
  However, permissions for /usr/bin/traceroute.db were never added.
  This patch fixes this.
  
  
  While on it, also change the /usr/sbin/traceroute permissions from
  rmix to the less confusing mrix.
  
  
  Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
------------------------------------------------------------
revno: 3348
committer: Tyler Hicks <tyhicks@canonical.com>
branch nick: apparmor-2.10
timestamp: Wed 2016-09-14 12:50:43 -0500
message:
  libapparmor: Force libtoolize to replace existing files
  
  Fixes build error when attempting to build and test the 2.10.95 release
  on Ubuntu 14.04:
  
   $ (cd libraries/libapparmor/ && ./autogen.sh && ./configure && \
     make && make check) > /dev/null
   ...
   libtool: Version mismatch error.  This is libtool 2.4.6 Debian-2.4.6-0.1, but the
   libtool: definition of this LT_INIT comes from libtool 2.4.2.
   libtool: You should recreate aclocal.m4 with macros from libtool 2.4.6 Debian-2.4.6-0.1
   libtool: and run autoconf again.
   make[2]: *** [grammar.lo] Error 63
   make[1]: *** [all] Error 2
   make: *** [all-recursive] Error 1
  
  The --force option is needed to regenerate the libtool file in
  libraries/libapparmor/.
  
  Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
  Acked-by: Steve Beattie <steve@nxnw.org>
------------------------------------------------------------
revno: 3347
committer: Christian Boltz <apparmor@cboltz.de>
branch nick: 2.10
timestamp: Mon 2016-09-12 23:35:00 +0200
message:
  Allow 'kcm' in network rules
  
  This is probably
  https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/plain/Documentation/networking/kcm.txt
  
  
  Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.10.

=== modified file 'libraries/libapparmor/autogen.sh'
--- libraries/libapparmor/autogen.sh	2014-01-03 23:13:26 +0000
+++ libraries/libapparmor/autogen.sh	2016-09-14 17:50:43 +0000
@@ -38,6 +38,6 @@
 echo "Running autoconf"
 autoconf --force
 echo "Running libtoolize"
-libtoolize --automake -c
+libtoolize --automake -c --force
 echo "Running automake"
 automake -ac

=== modified file 'profiles/apparmor.d/sbin.syslog-ng'
--- profiles/apparmor.d/sbin.syslog-ng	2015-11-11 15:44:47 +0000
+++ profiles/apparmor.d/sbin.syslog-ng	2016-10-13 18:29:59 +0000
@@ -48,6 +48,7 @@
   /{usr/,}sbin/syslog-ng mr,
   /sys/devices/system/cpu/online r,
   /usr/share/syslog-ng/** r,
+  /var/lib/syslog-ng/syslog-ng-?????.qf rw,
   # chrooted applications
   @{CHROOT_BASE}/var/lib/*/dev/log w,
   @{CHROOT_BASE}/var/lib/syslog-ng/syslog-ng.persist* rw,

=== modified file 'profiles/apparmor.d/usr.lib.dovecot.auth'
--- profiles/apparmor.d/usr.lib.dovecot.auth	2016-04-06 22:53:30 +0000
+++ profiles/apparmor.d/usr.lib.dovecot.auth	2016-10-05 18:53:37 +0000
@@ -38,7 +38,7 @@
   /var/tmp/smtp_* rw,
 
   /{var/,}run/dovecot/auth-token-secret.dat{,.tmp} rw,
-  /{var/,}run/dovecot/stats-user w,
+  /{var/,}run/dovecot/stats-user rw,
 
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.lib.dovecot.auth>

=== modified file 'profiles/apparmor.d/usr.lib.dovecot.config'
--- profiles/apparmor.d/usr.lib.dovecot.config	2014-06-27 19:14:53 +0000
+++ profiles/apparmor.d/usr.lib.dovecot.config	2016-10-05 18:53:37 +0000
@@ -23,6 +23,7 @@
   /usr/bin/doveconf rix,
   /usr/lib/dovecot/config mr,
   /usr/lib/dovecot/managesieve Px,
+  /usr/share/dovecot/** r,
 
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.lib.dovecot.config>

=== modified file 'profiles/apparmor.d/usr.lib.dovecot.imap'
--- profiles/apparmor.d/usr.lib.dovecot.imap	2015-09-03 16:27:00 +0000
+++ profiles/apparmor.d/usr.lib.dovecot.imap	2016-10-05 18:53:37 +0000
@@ -25,7 +25,14 @@
   @{DOVECOT_MAILSTORE}/** rwkl,
 
   @{HOME} r, # ???
-  /usr/lib/dovecot/imap mr,
+
+  /etc/dovecot/dovecot.conf r,
+  /etc/dovecot/conf.d/ r,
+  /etc/dovecot/conf.d/** r,
+
+  /usr/bin/doveconf rix,
+  /usr/lib/dovecot/imap mrix,
+  /usr/share/dovecot/** r,
   /{,var/}run/dovecot/auth-master rw,
   /{,var/}run/dovecot/mounts r,

=== modified file 'profiles/apparmor.d/usr.lib.dovecot.lmtp'
--- profiles/apparmor.d/usr.lib.dovecot.lmtp	2015-04-27 19:33:06 +0000
+++ profiles/apparmor.d/usr.lib.dovecot.lmtp	2016-10-05 18:53:37 +0000
@@ -25,6 +25,8 @@
   @{DOVECOT_MAILSTORE}/ rw,
   @{DOVECOT_MAILSTORE}/** rwkl,
 
+  @{HOME}/.dovecot.svbin r,
+
   /proc/*/mounts r,
   /tmp/dovecot.lmtp.* rw,
   /usr/lib/dovecot/lmtp mr,

=== modified file 'profiles/apparmor.d/usr.sbin.traceroute'
--- profiles/apparmor.d/usr.sbin.traceroute	2011-11-30 12:15:21 +0000
+++ profiles/apparmor.d/usr.sbin.traceroute	2016-09-29 22:08:08 +0000
@@ -20,7 +20,8 @@
   network inet raw,
   network inet6 raw,
 
-  /usr/sbin/traceroute rmix,
+  /usr/sbin/traceroute mrix,
+  /usr/bin/traceroute.db mrix,
   @{PROC}/net/route r,
 
   # Site-specific additions and overrides. See local/README for details.

=== modified file 'utils/apparmor/aa.py'
--- utils/apparmor/aa.py	2016-08-15 20:06:47 +0000
+++ utils/apparmor/aa.py	2016-10-01 18:25:51 +0000
@@ -1168,6 +1168,9 @@
                     prelog[aamode][profile][hat]['path'][path] = mode
 
                 if do_execute:
+                    if not aa[profile][hat]:
+                        continue  # ignore log entries for non-existing profiles
+
                     if profile_known_exec(aa[profile][hat], 'exec', exec_target):
                         continue

=== modified file 'utils/apparmor/rule/network.py'
--- utils/apparmor/rule/network.py	2016-02-18 22:31:56 +0000
+++ utils/apparmor/rule/network.py	2016-09-12 21:35:00 +0000
@@ -27,7 +27,7 @@
 network_domain_keywords   = [ 'unspec', 'unix', 'inet', 'ax25', 'ipx', 'appletalk', 'netrom', 'bridge', 'atmpvc', 'x25', 'inet6',
                               'rose', 'netbeui', 'security', 'key', 'netlink', 'packet', 'ash', 'econet', 'atmsvc', 'rds', 'sna',
                               'irda', 'pppox', 'wanpipe', 'llc', 'can', 'tipc', 'bluetooth', 'iucv', 'rxrpc', 'isdn', 'phonet',
-                              'ieee802154', 'caif', 'alg', 'nfc', 'vsock', 'mpls', 'ib' ]
+                              'ieee802154', 'caif', 'alg', 'nfc', 'vsock', 'mpls', 'ib', 'kcm' ]
 
 network_type_keywords     = ['stream', 'dgram', 'seqpacket', 'rdm', 'raw', 'packet']
 network_protocol_keywords = ['tcp', 'udp', 'icmp']

=== modified file 'utils/apparmor/ui.py'
--- utils/apparmor/ui.py	2014-11-17 12:30:04 +0000
+++ utils/apparmor/ui.py	2016-10-03 19:02:15 +0000
@@ -249,7 +249,6 @@
         'CMD_EXEC_IX_ON': _('(X) ix On'),
         'CMD_EXEC_IX_OFF': _('(X) ix Off'),
         'CMD_SAVE': _('(S)ave Changes'),
-        'CMD_CONTINUE': _('(C)ontinue Profiling'),
         'CMD_NEW': _('(N)ew'),
         'CMD_GLOB': _('(G)lob'),
         'CMD_GLOBEXT': _('Glob with (E)xtension'),
@@ -278,7 +277,6 @@
         'CMD_NET_FAMILY': _('Allow Network Fa(m)ily'),
         'CMD_OVERWRITE': _('(O)verwrite Profile'),
         'CMD_KEEP': _('(K)eep Profile'),
-        'CMD_CONTINUE': _('(C)ontinue'),
         'CMD_IGNORE_ENTRY': _('(I)gnore')
         }

Places

File changes-since-2.10.1--r3347..3353.diff of Package apparmor (Revision e88175e63b8a747477385f0a2a783937)

Places