~mvo/snapd/+git/snapd-mvo:2.59.5-screenly

Last commit made on 2023-06-28
Get this branch:
git clone -b 2.59.5-screenly https://git.launchpad.net/~mvo/snapd/+git/snapd-mvo

Branch merges

Branch information

Name:
2.59.5-screenly
Repository:
lp:~mvo/snapd/+git/snapd-mvo

Recent commits

e4a3b87... by Michael Vogt

release: 2.59.5+screenly2

6142d8a... by Michael Vogt

many: stop using `-O no-expr-simplify` in apparmor_parser

We recently ran into a real world profile bug where the option
`-O no-expr-simplify` causes a 10x increase in apparmor_parser
runtime and memory usage [1] that breaks existing customers.

The decision to use `-O no-expr-simplify` was taken in 2014 [2]
and the profiles back then where simpler. This commit will
make some profile generation slower but it will avoid going
into the exponential memory usage when compiled with
`apparmor_parser -O no-expr-simplify`.

[1] https://bugs.launchpad.net/snapd/+bug/2025030
[2] https://bugs.launchpad.net/ubuntu-rtm/+source/apparmor/+bug/1383858

8a7cdf2... by Michael Vogt

release: 2.59.5

390dc62... by Michael Vogt

tests: fix snap-seccomp-blocks-tty-injection on 32bit systems

2e93f91... by Michael Vogt

tests: fix snap-seccomp-blocks-tty-injection on partially confined systems and on ubuntu core

64cf6b0... by Alex Murray

tests/main/snap-seccomp-blocks-tty-injection: fix shellcheck errors

Signed-off-by: Alex Murray <email address hidden>

8ad5a73... by Alex Murray

cmd/snap-seccomp: Group similar variables together

Signed-off-by: Alex Murray <email address hidden>

e5e823b... by Alex Murray

tests/main/snap-seccomp-blocks-tty-injection: spread test CVE-2023-1523

Add a spread test which exercises the two tty injection PoCs for both
CVE-2023-1523 and CVE-2019-7303

Signed-off-by: Alex Murray <email address hidden>

52af545... by Alex Murray

snap-seccomp-blacklist: also disallow the use of ioctl + TIOCLINUX

Fixes CVE-2023-1523

Signed-off-by: Alex Murray <email address hidden>

dddcfd6... by Alex Murray

interfaces/seccomp: explicitly disallow the use of ioctl + TIOCLINUX

Fixes CVE-2023-1523

Signed-off-by: Alex Murray <email address hidden>