Merge lp:~apparmor-dev/apparmor/aa-2.8.95 into lp:~apparmor-dev/apparmor/apparmor-ubuntu-citrain

[Seth Arnold]

This AppArmor merge is based on the "trunk" of AppArmor upstream repository; because downstream consumers include a variety of package management systems where we have had trouble with -rc releases in the past, this is labeled 2.8.95 to be strictly less than 2.9 when that is eventually released. It is more in common with the forth-coming 2.9 than with the older 2.8.

This merge dropped many distro-patches which were upstreamed and adds several patches from upstream that are not yet in the repository, for functionalities highly desired for Ubuntu trusty.

> [TBD] Is your branch in sync with latest trunk (e.g. bzr pull lp:trunk -> no changes)

Yes, this pull was current as of 2014-03-11. Some upstream commiters are not Ubuntu members nor Canonical employees, but all commits require sign-off from other upstream commiters.

> Did you build your software in a clean sbuild/pbuilder chroot or ppa?

Yes, sbuild with schroot.

> Did you build your software in a clean sbuild/pbuilder chroot or ppa on armhf? (needed for TestPlan)

A build is currently queued in the security-private PPA.

> Has your component TestPlan been executed successfully on emulator/armhf Touch build (eg, one of N4, N10, N7 (either), Galaxy Nexus) and clean Ubuntu Desktop VM?

No; jdstrand has offered to test until other team members have a suitable environment configured.

> Has a 5 minute exploratory testing run been executed on an armhf Touch build (eg, one of N4, N10, N7 (either), Galaxy Nexus)?

No; jdstrand has offered to test until other team members have a suitable environment configured.

> If you changed the packaging (debian/), did you subscribe a core-dev to this MP?

jdstrand, a core-dev, will handle the merge proposal.

> What components might get impacted by your changes?

AppArmor confinement provides the basis for touch application confinement, LXC confinement, libvirt-managed kvm confinement, in addition to confining specific daemons, services, and programs. Nearly everything may be impacted by AppArmor.

> Have you requested review by the teams of these owning components?

No, it is not expected that others should be capable of reviewing these changes; both server team and touch teams are expecting the new features to be provided by this package.

[Jamie Strandboge (jdstrand)]

Thanks for the MP! Review based on this revision:

The mv -n is good at not clobbering, but it leaves the tempfile on disk. I think we want to do:
if [ ! -e /etc/apparmor.d/tunables/xdg-user-dirs.d/site.local ]; then
    tmp=`mktemp`
    ...
    mv -f "$tmp" /etc/apparmor.d/tunables/xdg-user-dirs.d/site.local
    chmod 644 /etc/apparmor.d/tunables/xdg-user-dirs.d/site.local
fi
;;

Version (2.8.95~2427-0ubuntu1~sarnold1) is not correct for trusty, but it is ok for now since we are going to build in a PPA. We can fix that later

Missing the powerpc fix.

I don't see anything in debian/rules about no longer installing odt files

review: Needs Fixing

[Jamie Strandboge (jdstrand)]

Oh, one more thing, the distribution name in debian/changelog should be UNRELEASED.

review: Needs Fixing

[lp:~apparmor-dev/apparmor/aa-2.8.95]

1498. By Seth Arnold on 2014-03-20

Modified patches to remove numbers, they complicated quilt handling too
much.

  - add-chromium-browser.patch
  - add-debian-integration-to-lighttpd.patch
  - ubuntu-manpage-updates.patch
  - libapparmor-layout-deb.patch
  - libapparmor-mention-dbus-method-in-getcon-man.patch
  - etc-writable.patch
  - aa-utils_are_bilingual.patch
  - convert-to-rules.patch
  - list-fns.patch
  - parse-mode.patch
  - add-decimal-interp.patch
  - policy_mediates.patch
  - fix-failpath.patch
  - feature_file.patch
  - fix-network.patch
  - aare-to-class.patch
  - add-mediation-unix.patch
  - parser_version.patch
  - caching.patch
  - label-class.patch
  - fix-lexer-debug.patch
  - use-diff-encode.patch
  - fix-serialize.patch
  - fix-ppc-endian-ftbfs.patch
  - opt_arg.patch
  - tests-cond-dbus.patch

Unmerged revisions

=== modified file 'debian/apparmor.postinst'
--- debian/apparmor.postinst	2014-03-12 02:05:16 +0000
+++ debian/apparmor.postinst	2014-03-13 20:23:16 +0000
@@ -84,7 +84,7 @@
 EOM
 
 	mkdir -p /etc/apparmor.d/tunables/xdg-user-dirs.d 2>/dev/null || true
-	mv -f "$tmp" /etc/apparmor.d/tunables/xdg-user-dirs.d/site.local
+	mv -n "$tmp" /etc/apparmor.d/tunables/xdg-user-dirs.d/site.local
 	chmod 644 /etc/apparmor.d/tunables/xdg-user-dirs.d/site.local
 	;;
 
 
=== modified file 'debian/changelog'
--- debian/changelog	2014-03-12 02:05:16 +0000
+++ debian/changelog	2014-03-13 20:23:16 +0000
@@ -1,4 +1,4 @@
-apparmor (2.8.95~2427-0ubuntu1) trusty; urgency=low
+apparmor (2.8.95~2427-0ubuntu1~sarnold1) trusty; urgency=low
 
   [ Jamie Strandboge ]
 
@@ -20,8 +20,8 @@
       for the aa_query_label() function
     - Raise exceptions in Python bindings when something fails
   * ship new Python replacements for previous Perl-based tools
-    - debian/apparmor-utils.install: remove usr/share/perl5/Immunix/*.pm and add
-      usr/sbin/aa-autodep, usr/sbin/aa-cleanprof and usr/sbin/aa-mergeprof
+    - debian/apparmor-utils.install: remove usr/share/perl5/Immunix/*.pm and
+      add usr/sbin/aa-autodep, usr/sbin/aa-cleanprof and usr/sbin/aa-mergeprof
     - debian/control:
       + remove various Perl dependencies
       + add python-apparmor and python3-apparmor
@@ -35,7 +35,8 @@
       and xdg-user-dirs tunables and xdg-user-dirs.d directory
   * debian/apparmor.dirs:
     - install /etc/apparmor.d/tunables/xdg-user-dirs.d
-  * debian/apparmor.postinst: create xdg-user-dirs.d
+  * debian/rules: delete upstream-provided xdg-user-dirs.d/site.local
+  * debian/apparmor.postinst: create xdg-user-dirs.d/site.local
   * debian/apparmor.postrm: remove xdg-user-dirs.d
   * Remaining patches:
     - 0001-add-chromium-browser.patch
@@ -82,7 +83,7 @@
     - debian/apparmor.install: tunables/dovecot, tunables/kernelvars,
       tunables/xdg-user-dirs, tunables/xdg-user-dirs.d
 
- -- Seth Arnold <[e-mail]>  Tue, 11 Mar 2014 16:39:06 -0700
+ -- Seth Arnold <[e-mail]>  Thu, 13 Mar 2014 12:30:09 -0700
 
 apparmor (2.8.94-0ubuntu1.4) trusty; urgency=low
 
 
=== removed file 'debian/patches/0007-sanitized_helper_dbus_access.patch'
--- debian/patches/0007-sanitized_helper_dbus_access.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0007-sanitized_helper_dbus_access.patch	1970-01-01 00:00:00 +0000
@@ -1,21 +0,0 @@
-Author: Jamie Strandboge <[e-mail]>
-Description: Allow applications run under sanitized_helper to connect to DBus
-
----
- profiles/apparmor.d/abstractions/ubuntu-helpers |    3 +++
- 1 file changed, 3 insertions(+)
-
-Index: b/profiles/apparmor.d/abstractions/ubuntu-helpers
-===================================================================
---- a/profiles/apparmor.d/abstractions/ubuntu-helpers
-+++ b/profiles/apparmor.d/abstractions/ubuntu-helpers
-@@ -41,6 +41,9 @@
-   # Allow all DBus communications
-   dbus,
- 
-+  # Allow all DBus communications
-+  dbus,
-+
-   # Allow exec of anything, but under this profile. Allow transition
-   # to other profiles if they exist.
-   /bin/* Pixr,
 
=== removed file 'debian/patches/0008-libapparmor-adjust_symbol_map-more_invasive_version.patch'
--- debian/patches/0008-libapparmor-adjust_symbol_map-more_invasive_version.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0008-libapparmor-adjust_symbol_map-more_invasive_version.patch	1970-01-01 00:00:00 +0000
@@ -1,55 +0,0 @@
-Signed-off-by: Steve Beattie <[e-mail]>
----
- libraries/libapparmor/src/kernel_interface.c |   10 ++++++++--
- libraries/libapparmor/src/libapparmor.map    |    9 ++++++++-
- 2 files changed, 16 insertions(+), 3 deletions(-)
-
-Index: b/libraries/libapparmor/src/libapparmor.map
-===================================================================
---- a/libraries/libapparmor/src/libapparmor.map
-+++ b/libraries/libapparmor/src/libapparmor.map
-@@ -1,4 +1,8 @@
--#If you update this file please update the library version in Makefile.am
-+# Please add new symbols in a section that corresponds to the upcoming
-+# release version, adding a new section if necessary
-+#
-+# If you update this file please follow the instructions on library
-+# versioning in Makefile.am
- 
- IMMUNIX_1.0 {
-   global:
-@@ -33,6 +37,9 @@ APPARMOR_1.1 {
-         free_record;
-         aa_getprocattr_raw;
-         aa_getprocattr;
-+        aa_query_label;
-+
-+	# no more symbols here, please
- 
-   local:
- 	*;
-Index: b/libraries/libapparmor/src/kernel_interface.c
-===================================================================
---- a/libraries/libapparmor/src/kernel_interface.c
-+++ b/libraries/libapparmor/src/kernel_interface.c
-@@ -702,8 +702,8 @@ static void aafs_access_init_once(void)
-  *          ENOENT, the subject label in the query string is unknown to the
-  *          kernel.
-  */
--int aa_query_label(uint32_t mask, char *query, size_t size, int *allowed,
--		   int *audited)
-+int query_label(uint32_t mask, char *query, size_t size, int *allowed,
-+		int *audited)
- {
- 	char buf[QUERY_LABEL_REPLY_LEN];
- 	uint32_t allow, deny, audit, quiet;
-@@ -770,3 +770,9 @@ int aa_query_label(uint32_t mask, char *
- 
- 	return 0;
- }
-+
-+/* export multiple aa_query_label symbols to compensate for downstream
-+ * releases with differing symbol versions. */
-+extern typeof((query_label)) __aa_query_label __attribute__((alias ("query_label")));
-+symbol_version(__aa_query_label, aa_query_label, APPARMOR_1.1);
-+default_symbol_version(query_label, aa_query_label, APPARMOR_3.0);
 
=== modified file 'debian/patches/0008-remove-ptrace.patch'
--- debian/patches/0008-remove-ptrace.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0008-remove-ptrace.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,8 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Remove old, never-used, ptrace infrastructure from the parser
+---
+
 It was never used, never supported, and we are doing it differently now.
 
 Signed-off-by: John Johansen <[e-mail]>
 
=== modified file 'debian/patches/0009-convert-to-rules.patch'
--- debian/patches/0009-convert-to-rules.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0009-convert-to-rules.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,8 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Convert mount and dbus to be subclasses of a generic rule class
+---
+
 This will simplify add new features as most of the code can reside in
 its own class. There are still things to improve but its a start.
 
 
=== removed file 'debian/patches/0009-libapparmor2.patch'
--- debian/patches/0009-libapparmor2.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0009-libapparmor2.patch	1970-01-01 00:00:00 +0000
@@ -1,26 +0,0 @@
-Subject: libapparmor1 -> libapparmor2 in autoconf
-Author: Seth Arnold <[e-mail]>
-
-The library version has changed to 2:
-
-AA_LIB_CURRENT = 2
-AA_LIB_REVISION = 0
-AA_LIB_AGE = 0
-
----
- libraries/libapparmor/configure.ac |    2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-Index: b/libraries/libapparmor/configure.ac
-===================================================================
---- a/libraries/libapparmor/configure.ac
-+++ b/libraries/libapparmor/configure.ac
-@@ -5,7 +5,7 @@
- 
- AC_INIT(configure.ac)
- 
--AM_INIT_AUTOMAKE(libapparmor1, apparmor_version)
-+AM_INIT_AUTOMAKE(libapparmor2, apparmor_version)
- 
- AM_PROG_LEX
- AC_PROG_YACC
 
=== removed file 'debian/patches/0009-uservars-inc-use-system-support.patch'
--- debian/patches/0009-uservars-inc-use-system-support.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0009-uservars-inc-use-system-support.patch	1970-01-01 00:00:00 +0000
@@ -1,95 +0,0 @@
-Description: Modify regression tests to use USE_SYSTEM to also select parser
-Author: Seth Arnold <[e-mail]>
-
----
- tests/regression/apparmor/Makefile            |   11 +++++++++--
- tests/regression/apparmor/uservars.inc        |   14 --------------
- tests/regression/apparmor/uservars.inc.source |   14 ++++++++++++++
- tests/regression/apparmor/uservars.inc.system |   14 ++++++++++++++
- 4 files changed, 37 insertions(+), 16 deletions(-)
-
-Index: b/tests/regression/apparmor/Makefile
-===================================================================
---- a/tests/regression/apparmor/Makefile
-+++ b/tests/regression/apparmor/Makefile
-@@ -180,7 +180,14 @@
- 		return 1 ; \
- 	fi
- 
--all: libapparmor_check $(EXEC) changehat.h
-+all: libapparmor_check $(EXEC) changehat.h uservars.inc
-+
-+uservars.inc: uservars.inc.source uservars.inc.system
-+ifdef USE_SYSTEM
-+	mv uservars.inc.system uservars.inc
-+else # !USE_SYSTEM
-+	mv uservars.inc.source uservars.inc
-+endif # USE_SYSTEM
- 
- changehat_pthread: changehat_pthread.c changehat.h
- 	${CC} ${CFLAGS} ${LDFLAGS} $< -o $@ ${LDLIBS} -pthread
-@@ -236,6 +243,6 @@
- 	fi
- 
- clean:
--	rm -f $(EXEC) dbus_common.o
-+	rm -f $(EXEC) dbus_common.o uservars.inc
- 
- regex.sh: open exec
-Index: b/tests/regression/apparmor/uservars.inc.source
-===================================================================
---- /dev/null
-+++ b/tests/regression/apparmor/uservars.inc.source
-@@ -0,0 +1,14 @@
-+# 1. Path to apparmor parser
-+subdomain=${PWD}/../../../parser/apparmor_parser
-+#subdomain=/sbin/apparmor_parser
-+
-+# 2. additional arguments to the apparmor parser
-+parser_args="-q -K"
-+
-+# 3. directory to be used for temp files
-+# Need to be able to access this directory by the root and nobody users.
-+tmpdir=/tmp/sdtest.$$-$RANDOM
-+
-+
-+# 4. Location of load system profiles for verification
-+sys_profiles=/sys/kernel/security/apparmor/profiles
-Index: b/tests/regression/apparmor/uservars.inc.system
-===================================================================
---- /dev/null
-+++ b/tests/regression/apparmor/uservars.inc.system
-@@ -0,0 +1,14 @@
-+# 1. Path to apparmor parser
-+#subdomain=${PWD}/../../../parser/apparmor_parser
-+subdomain=/sbin/apparmor_parser
-+
-+# 2. additional arguments to the apparmor parser
-+parser_args="-q -K"
-+
-+# 3. directory to be used for temp files
-+# Need to be able to access this directory by the root and nobody users.
-+tmpdir=/tmp/sdtest.$$-$RANDOM
-+
-+
-+# 4. Location of load system profiles for verification
-+sys_profiles=/sys/kernel/security/apparmor/profiles
-Index: b/tests/regression/apparmor/uservars.inc
-===================================================================
---- a/tests/regression/apparmor/uservars.inc
-+++ /dev/null
-@@ -1,14 +0,0 @@
--# 1. Path to apparmor parser
--subdomain=${PWD}/../../../parser/apparmor_parser
--#subdomain=/sbin/apparmor_parser
--
--# 2. additional arguments to the apparmor parser
--parser_args="-q -K"
--
--# 3. directory to be used for temp files
--# Need to be able to access this directory by the root and nobody users.
--tmpdir=/tmp/sdtest.$$-$RANDOM
--
--
--# 4. Location of load system profiles for verification
--sys_profiles=/sys/kernel/security/apparmor/profiles
 
=== modified file 'debian/patches/0010-list-fns.patch'
--- debian/patches/0010-list-fns.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0010-list-fns.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: cleanup the list fns and use a little bit.
+
+---
+
 Yes its seems pointless because these will eventually get replaced by
 stl. But until then
 
 
=== modified file 'debian/patches/0011-parse-mode.patch'
--- debian/patches/0011-parse-mode.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0011-parse-mode.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: make the parse_sub_mode code more generic
+
+---
+
 Make it more generic so that it can be shared with signals.
 
 Signed-off-by: John Johansen <[e-mail]>
 
=== modified file 'debian/patches/0012-add-decimal-interp.patch'
--- debian/patches/0012-add-decimal-interp.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0012-add-decimal-interp.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: cleanup/fix escape sequences in the backend and add support for \d
+
+---
+
 the octal escape sequence was broken, so that short escapes \0, \00 \xa,
 didn't work and actually resulted in some encoding bugs.
 
 
=== modified file 'debian/patches/0013-policy_mediates.patch'
--- debian/patches/0013-policy_mediates.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0013-policy_mediates.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Add stub rules to indicate compilation support for given features.
+
+---
+
 Policy enforcement needs to be able to support older userspaces and
 compilers that don't know about new features. The absence of a feature
 in the policydb indicates that feature mediation is not present for
 
=== modified file 'debian/patches/0014-fix-failpath.patch'
--- debian/patches/0014-fix-failpath.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0014-fix-failpath.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: fix failure paths around policy that can result in a crash
+
+---
+
 Signed-off-by: John Johansen <[e-mail]>
 
 ---
 
=== modified file 'debian/patches/0015-feature_file.patch'
--- debian/patches/0015-feature_file.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0015-feature_file.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Hack rework of the feature/match file support
+
+---
+
 This is not the cleanup this code needs, but a quick hack to add the
 -M flag so we can specify a feature file (or directory) to use for
 the compile.
 
=== modified file 'debian/patches/0016-fix-network.patch'
--- debian/patches/0016-fix-network.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0016-fix-network.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: fix: network detection
+
+---
+
 The features file patch broke detection of network support.
 
 Signed-off-by: John Johansen <[e-mail]>
 
=== modified file 'debian/patches/0017-aare-to-class.patch'
--- debian/patches/0017-aare-to-class.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0017-aare-to-class.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Convert aare_rules into a class
+
+---
+
 This cleans things up a bit and fixes a bug where not all rules are
 getting properly counted so that the addition of policy_mediation
 rules fails to generate the policy dfa in some cases.
 
=== modified file 'debian/patches/0018-add-mediation-unix.patch'
--- debian/patches/0018-add-mediation-unix.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0018-add-mediation-unix.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Add tag indicating file policy is mediated.
+
+---
+
 Tag start of entries in the policydb as being mediated. This makes
 the start state for any class being mediated be none 0. The kernel
 can detect this to determine whether the parser expected mediation
 
=== modified file 'debian/patches/0019-parser_version.patch'
--- debian/patches/0019-parser_version.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0019-parser_version.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Add the ability to separate policy_version from kernel and parser abi
+
+---
+
 This will allow for the parser to invalidate its caches separate of whether
 the kernel policy version has changed. This can be desirable if a parser
 bug is discovered, a new version the parser is shipped and we need to
 
=== modified file 'debian/patches/0020-caching.patch'
--- debian/patches/0020-caching.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0020-caching.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Dont use the parser time stamp to determine if policy is newer.
+
+---
+
 Using the parser timestamp was a work around to force recompilation of
 policy that was built with a buggy parser. There are better ways to
 handle this so remove checking of the parser timestamp.
 
=== modified file 'debian/patches/0021-label-class.patch'
--- debian/patches/0021-label-class.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0021-label-class.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: add label class to the policydb
+
+---
+
 The label class is used to lookup object permissions based off of label
 alone when the labeling is not path dependent.
 
 
=== modified file 'debian/patches/0022-signal.patch'
--- debian/patches/0022-signal.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0022-signal.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Add the ability to mediate signals.
+
+---
+
 Add signal rules and make sure the parser encodes support for them
 if the supported feature set reports supporting them.
 
 
=== modified file 'debian/patches/0023-fix-lexer-debug.patch'
--- debian/patches/0023-fix-lexer-debug.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0023-fix-lexer-debug.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: A few fixes/improvements to the lexer debug output
+
+---
+
 Signed-off-by: John Johansen <[e-mail]>
 ---
  parser/parser_lex.l |   19 +++++++++----------
 
=== modified file 'debian/patches/0024-ptrace.patch'
--- debian/patches/0024-ptrace.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0024-ptrace.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Add the ability to specify ptrace rules
+
+---
+
 ptrace rules currently take the form of
 
   ptrace [<ptrace_perms>] [<peer_profile_name>],
 
=== modified file 'debian/patches/0025-use-diff-encode.patch'
--- debian/patches/0025-use-diff-encode.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0025-use-diff-encode.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Turn on diff-encoding if the kernel supports it
+
+---
+
 Signed-off-by: John Johansen <[e-mail]>
 ---
  parser/parser.h        |    1 +
 
=== modified file 'debian/patches/0026-fix-serialize.patch'
--- debian/patches/0026-fix-serialize.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0026-fix-serialize.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Move buffer management for the interface to C++ ostringstream class
+
+---
+
 Signed-off-by: John Johansen <[e-mail]>
 ---
  parser/parser.h           |    5 
 
=== modified file 'debian/patches/0027-fix-af.patch'
--- debian/patches/0027-fix-af.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0027-fix-af.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,8 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Don't mediate AF_UNSPEC address family
+---
+
 ---
  common/Make.rules |    2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
=== modified file 'debian/patches/0028-opt_arg.patch'
--- debian/patches/0028-opt_arg.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0028-opt_arg.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,8 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Split flag handling into a separate file
+---
+
 Signed-off-by: John Johansen <[e-mail]>
 
 ----
 
=== modified file 'debian/patches/0029-tests-cond-dbus.patch'
--- debian/patches/0029-tests-cond-dbus.patch	2014-03-12 02:05:16 +0000
+++ debian/patches/0029-tests-cond-dbus.patch	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Make dbus tests be conditionally run based on pkg-config
+
+---
+
 The addition of the dbus tests requires dbus dev libraries be installed
 to run the test suite. This is not always desirable or even possible.
 
 
=== modified file 'debian/patches/0030-tests.diff'
--- debian/patches/0030-tests.diff	2014-03-12 02:05:16 +0000
+++ debian/patches/0030-tests.diff	2014-03-13 20:23:16 +0000
@@ -1,3 +1,9 @@
+Author: John Johansen <[e-mail]>
+Forwarded: Yes
+Subject: Update the regression tests for v6 policy
+
+---
+
 Sorry this mashes several things together that should be separate
 patches, but I am not going to spend the time to pull them apart
 atm.