lp:apparmor

Get this repository:
git clone https://git.launchpad.net/apparmor

Import details

Import Status: Reviewed

This repository is an import of the Git repository at https://gitlab.com/apparmor/apparmor.git.

The next import is scheduled to run in 3 hours.

Last successful import was 2 hours ago.

Import started 2 hours ago on alnitak and finished 2 hours ago taking 1 minute — see the log
Import started 8 hours ago on alnitak and finished 8 hours ago taking 40 seconds — see the log
Import started 14 hours ago on alnitak and finished 14 hours ago taking 30 seconds — see the log
Import started 20 hours ago on alnitak and finished 20 hours ago taking 40 seconds — see the log
Import started on 2020-11-30 on alnitak and finished on 2020-11-30 taking 30 seconds — see the log
Import started on 2020-11-30 on alnitak and finished on 2020-11-30 taking 40 seconds — see the log
Import started on 2020-11-30 on alnitak and finished on 2020-11-30 taking 40 seconds — see the log
Import started on 2020-11-30 on alnitak and finished on 2020-11-30 taking 40 seconds — see the log
Import started on 2020-11-29 on alnitak and finished on 2020-11-29 taking 40 seconds — see the log
Import started on 2020-11-29 on alnitak and finished on 2020-11-29 taking 40 seconds — see the log

Updating repository...

Launchpad is processing new changes to this repository which will be available shortly. Reload to see the changes.

Branches

Name Last Modified Last Commit
master 2020-12-01 20:57:34 UTC 4 hours ago
Merge branch 'codespell-fixes' into 'master'

Author: Steve Beattie
Author Date: 2020-12-01 20:57:34 UTC

Merge branch 'codespell-fixes' into 'master'

treewide: spelling fixes identified partially by codespell

See merge request apparmor/apparmor!687

apparmor-3.0 2020-11-30 13:22:12 UTC 2020-11-30
aa-notify: don't crash if the logfile is not present due to rotation

Author: John Johansen
Author Date: 2020-11-28 12:48:47 UTC

aa-notify: don't crash if the logfile is not present due to rotation

If aa-notify races file rotation it may crash with a trace back to
the log file being removed before the new one is moved into place.

    Traceback (most recent call last):
       File "/usr/sbin/aa-notify", line 570, in <module>
         main()
       File "/usr/sbin/aa-notify", line 533, in main
          for message in notify_about_new_entries(logfile, args.wait):
       File "/usr/sbin/aa-notify", line 145, in notify_about_new_entries
         for event in follow_apparmor_events(logfile, wait):
       File "/usr/sbin/aa-notify", line 236, in follow_apparmor_events
         if os.stat(logfile).st_ino != log_inode:
    FileNotFoundError: [Errno 2] No such file or directory: '/var/log/audit/audit.log'

If we hit this situation sleep and then retry opening the logfile.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/130
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/688
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
(cherry picked from commit 7c88f02d6a2a367b3ac6b84366d07b9d6de1869d)

apparmor-2.11 2020-11-28 13:15:14 UTC 2020-11-28
aa-autodep: load abstractions on start

Author: Christian Boltz
Author Date: 2020-11-08 13:41:33 UTC

aa-autodep: load abstractions on start

So far, aa-autodep "accidently" loaded the abstractions when parsing the
existing profiles. Obviously, this only worked if there is at least one
profile in the active or extra profile directory.

Without any existing profiles, aa-autodep crashed with
KeyError: '/tmp/apparmor.d/abstractions/base'

Prevent this crash by explicitely loading the abstractions on start.

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1178527#c1 [1]
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/682
(cherry picked from commit f6b3de71161f9acfa177e879017560000b7ffde8)
Signed-off-by: John Johansen <john.johansen@canonical.com>

apparmor-2.12 2020-11-28 13:14:36 UTC 2020-11-28
aa-autodep: load abstractions on start

Author: Christian Boltz
Author Date: 2020-11-08 13:41:33 UTC

aa-autodep: load abstractions on start

So far, aa-autodep "accidently" loaded the abstractions when parsing the
existing profiles. Obviously, this only worked if there is at least one
profile in the active or extra profile directory.

Without any existing profiles, aa-autodep crashed with
KeyError: '/tmp/apparmor.d/abstractions/base'

Prevent this crash by explicitely loading the abstractions on start.

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1178527#c1 [1]
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/682
(cherry picked from commit f6b3de71161f9acfa177e879017560000b7ffde8)
Signed-off-by: John Johansen <john.johansen@canonical.com>

apparmor-2.13 2020-11-28 13:13:51 UTC 2020-11-28
aa-autodep: load abstractions on start

Author: Christian Boltz
Author Date: 2020-11-08 13:41:33 UTC

aa-autodep: load abstractions on start

So far, aa-autodep "accidently" loaded the abstractions when parsing the
existing profiles. Obviously, this only worked if there is at least one
profile in the active or extra profile directory.

Without any existing profiles, aa-autodep crashed with
KeyError: '/tmp/apparmor.d/abstractions/base'

Prevent this crash by explicitely loading the abstractions on start.

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1178527#c1 [1]
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/682
(cherry picked from commit f6b3de71161f9acfa177e879017560000b7ffde8)
Signed-off-by: John Johansen <john.johansen@canonical.com>

apparmor-2.10 2020-11-17 10:09:41 UTC 2020-11-17
abstractions/X: Allow (only) reading X compose cache

Author: Christian Boltz
Author Date: 2020-11-16 19:42:00 UTC

abstractions/X: Allow (only) reading X compose cache

... (/var/cache/libx11/compose/*), and deny any write attempts

Reported by darix,
https://git.nordisch.org/darix/apparmor-profiles-nordisch/-/blob/master/apparmor.d/teams

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/685
(cherry picked from commit 78bd811e2a23f55974991cd208f6a17749655c21)
Signed-off-by: John Johansen <john.johansen@canonical.com>

cherry-pick-d257afd3 2020-04-02 08:49:51 UTC 2020-04-02
Add xdg-open (and friends) abstraction

Author: John Johansen
Author Date: 2020-02-03 21:32:21 UTC

Add xdg-open (and friends) abstraction

Implement set of abstractions to handle opening uris via xdg-open and similar helpers used on different desktop environments.

Abstractions are intended to be included into child profile, together with bundle abstractions such as ubuntu-browsers, ubuntu-email and others, for fine-grained control on what confined application can actually open via xdg-open and similar helpers.

PR: https://gitlab.com/apparmor/apparmor/-/merge_requests/404
Acked-by: John Johansen <john.johansen@canonical.com>

(cherry picked from commit d257afd3096b25f5d76e2575478c13d4f6930f9a)

622fc44b Add xdg-open (and friends) abstraction
af278ca6 exo-open: Fix denials on OpenSUSE
f07f0771 exo-open: Allow playing alert sounds
80514906 kde-open5: use dbus-network-manager-strict abstraction
ac08dc66 kde-open5: fix denies Ubuntu Eoan
501aada8 gio-open: fix denies Ubuntu Eoan
0a55babe exo-open: do not enable a11y by default
e77abfa5 exo-open: update comment about DBUS denial
d35faafd kde-open5: do not enable a11y by default
8b481d46 kde-open5: do not enable gstreamer support by default
162e5086 xdg-open: update usage example

cherry-pick-d4296d21 2020-03-31 21:02:18 UTC 2020-03-31
Merge: abstractions/nameservice: allow accessing /run/systemd/userdb/

Author: John Johansen
Author Date: 2020-03-29 08:51:55 UTC

Merge: abstractions/nameservice: allow accessing /run/systemd/userdb/

On systems with systemd 245, `nss-systemd` additionally queries NSS records from `systemd-userdbd.service`. See https://systemd.io/USER_GROUP_API/ .

This does not bring full support for `systemd-homed`, but I don't use that service so I can't help with that.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/82
PR: https://gitlab.com/apparmor/apparmor/-/merge_requests/459
Acked-by: John Johansen <john.johansen@canonical.com>

(cherry picked from commit d4296d217c888e08e10bec300fe35351c2ef2f81)

16f9f688 abstractions/nameservice: allow accessing /run/systemd/userdb/

apparmor-2.9 2018-06-29 18:30:00 UTC 2018-06-29
profiles: adjust abstractions/python for python 3.7

Author: Christian Boltz
Author Date: 2018-06-28 11:34:08 UTC

profiles: adjust abstractions/python for python 3.7

Python 3.7 was released yesterday - and to make the abstraction
future-proof, also cover 3.8 and 3.9 in advance ;-)

(cherry picked from commit 01f41fbff821be7264a4b0aac83ed04747395055)

Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
PR: https://gitlab.com/apparmor/apparmor/merge_requests/139

apparmor-2.8 2017-10-28 05:46:04 UTC 2017-10-28
git conversion: move .bzrignore to .gitignore

Author: Steve Beattie
Author Date: 2017-10-28 05:46:04 UTC

git conversion: move .bzrignore to .gitignore

Signed-off-by: Steve Beattie <steve.beattie@canonical.com>

apparmor-2.7 2012-04-25 19:58:58 UTC 2012-04-25
Merge from trunk rev 2037:

Author: Kees Cook
Author Date: 2012-04-25 19:58:58 UTC

Merge from trunk rev 2037:

The m4 shipped to handle Python was incorrectly clearing
$CPPFLAGS. Additionally, do not repeat compiler flags for automake
targets that already include them, and pass more flags to the Perl build.

Signed-off-by: Kees Cook <kees@ubuntu.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>

apparmor-2.6 2011-08-26 23:03:03 UTC 2011-08-26
Merge from trunk revision 1805:

Author: Steve Beattie
Author Date: 2011-08-26 23:03:03 UTC

Merge from trunk revision 1805:

  Attached is a patch to make the initscript not fail if /tmp is full
  by converting the comm(1) usage on temporary files to an embedded
  awk script. On both Ubuntu and OpenSUSE, a version of awk (mawk in
  Ubuntu, gawk in OpenSUSE) is either a direct or indirect dependency
  on the minimal or base package set, and the original reporter also
  mentioned that an awk-based solution would be palatable in a way
  that converting to bash, or using perl or python here would not be.

  In the embedded awk script, I've tried to avoid gawk or mawk
  specific behaviors or extensions; e.g. this is the reason for the
  call to sort on the output of the awk script, rather than using
  gawk's asort(). But please let me know if you see anything that
  shouldn't be portable across awk implementations.

  An additional issue that is fixed in both scripts is handling
  child profiles (e.g. hats) during reload. If child profiles are
  filtered out (via grep -v '//') of the list to consider, then
  on reloading a profile where a child profile has been removed or
  renamed, that child profile will continue to stick around. However,
  if the profile containing child profiles is removed entirely,
  if the initscript attempts to unload the child profiles after the
  parent is removed, this will fail because they were unloaded when
  the parent was unloaded. Thus I removed any filtering of child
  profiles out, but do a post-awk reverse sort which guarantees that
  any child profiles will be removed before their parent is. I also
  added the LC_COLLATE=C (based on the Ubuntu version) to the sort
  call to ensure a consistent sort order.

  To restate, the problem with the existing code is that it creates
  temporary files in $TMPDIR (by default /tmp) and if that partition
  is full, problems with the reload action ensue. Alternate solutions
  include switching the initscript to use bash and its <$() extension
  or setting TMPDIR to /dev/shm/. The former is unpalatable to some
  (particularly for an initscript), and for the latter, /dev/shm is
  only guaranteed to exist on GNU libc based systems (glibc apparently
  expects /dev/shm to exist for its POSIX shared memory implementation;
  see shm_overview(7)). So to me, awk (sans GNU extensions) looks
  to be the least bad option here.

Nominated-By: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: John Johansen <john.johansen@canonical.com>

Bug: https://launchpad.net/bugs/775785

apparmor-2.5 2011-06-06 17:39:54 UTC 2011-06-06
Rename tags to conform with git tag requirements

Author: John Johansen
Author Date: 2011-06-06 17:39:54 UTC

Rename tags to conform with git tag requirements

Rename tags
  apparmor_2.5.2~rc1 to apparmor_2.5.2-rc1
  apparmor_2.6.0~rc1 to apparmor_2.6.0-rc1

this is necessary for export to the git mirror

Signed-off-by: John Johansen <john.johansen@canonical.com>

apparmor-2.3 2008-05-27 12:04:33 UTC 2008-05-27
remove for-mainline dir from kernel patches

Author: John Johansen
Author Date: 2008-05-27 12:04:33 UTC

remove for-mainline dir from kernel patches

apparmor-2.1 2008-03-28 07:19:57 UTC 2008-03-28
merge -r 1158 - fix fatal errors so that they have an exit with an exit code

Author: John Johansen
Author Date: 2008-03-28 07:19:57 UTC

merge -r 1158 - fix fatal errors so that they have an exit with an exit code
of 127

115 of 15 results
This repository contains Public information 
Everyone can see this information.