Comment 17 for bug 1658219

On 2019-04-03 03:06:09, thighland wrote:
> I encountered this issue on xenial after updating to Azure's 4.15 kernel
> for testing. We started encountering an apparmor deny which doesn't
> happen on the latest 4.4 kernel. I had missed setting the k flag for a
> policy, and everything worked on the new kerenl once we fixed the
> policy.
>
> Given that this bug leads to incorrect enforcement of policy does it
> make sense to release a fix for xenial?

I spoke with John Johansen and Jamie Strandboge about this today. We all
agree that it would be really nice to backport the fix but,
unfortunately, it is also very risky.

Any time that we begin mediating an operation, it requires policy to be
updated to allow the operation in the appropriate profiles. This
typically happens during the development cycle of Ubuntu when we are
landing a new version of the kernel. This gives us sufficient testing,
by the time the Ubuntu release happens, in order to sort out any
problems. Also, users with custom policy have some reasonable
expectation that upgrading to the new Ubuntu release or kernel version
will require them to update their custom policy.

In this situation, we'd be mediating locking after Ubuntu 16.04 has been
released and in use for 3 years. It is quite likely to result in broken
systems after the kernel update. We may be able to sort out all the
problems with profiles shipped as part of the distro but obviously could
not fix custom AppArmor policies that users have implemented.

We'll give it some more thought to see if it is something that we can
safely backport to the 4.4 kernel but at this time the feeling is that
it is too likely to regress users.