Merge ~paelzer/ubuntu/+source/openldap:lp-1909748-apparmor-ssl-keys into ubuntu/+source/openldap:ubuntu/hirsute-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://bileto.ubuntu.com/#/ticket/4384

[Paride Legovini (paride)]

Hi Christian,

This LGTM, I just have a question on the best order to upload things. I have this MP merging 2.4.56+dfsg-1 to Hirsute:

https://code.launchpad.net/~paride/ubuntu/+source/openldap/+git/openldap/+merge/395533

Already reviewed by Bryce, needing sponsorship. Should I rebase it on top of 2.4.53+dfsg-1ubuntu6 (this MP), or should we upload it and then update this MP on top of the new version?

review: Needs Information

[Christian Ehrhardt  (paelzer)]

Hi Paride,

Rebasing on mine - bad since it never existed in Ubuntu so far.
Best way to go is that you just cherry pick my change into your branch.
Then add a changelog entry.

I can quickly re-review your MP then and we can sponsor it.

[Christian Ehrhardt  (paelzer)]

Merged into he other MP, self-rejecting this one.

Unmerged commits

82ab16e... by Christian Ehrhardt  on 2021-01-04

changelog: mention Author

Signed-off-by: Christian Ehrhardt <email address hidden>

13d02fb... by Christian Ehrhardt  on 2021-01-04

changelog: use abstractions/ssl_keys (LP: #1909748)

Signed-off-by: Christian Ehrhardt <email address hidden>

0275fd4... by Christian Ehrhardt  on 2021-01-04

d/apparmor-profile: use abstractions/ssl_keys instead of manual rules, allows lets-encrypt (LP: #1909748)

Signed-off-by: Christian Ehrhardt <email address hidden>

diff --git a/debian/apparmor-profile b/debian/apparmor-profile
index 9e1070f..1e9035b 100644
--- a/debian/apparmor-profile
+++ b/debian/apparmor-profile
@@ -9,9 +9,8 @@
   #include <abstractions/nameservice>
   #include <abstractions/p11-kit>
 
+  #include <abstractions/ssl_keys>
   #include <abstractions/ssl_certs>
-  /etc/ssl/private/ r,
-  /etc/ssl/private/* r,
 
   /etc/sasldb2 r,
 
diff --git a/debian/changelog b/debian/changelog
index 6943e4f..f256c64 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openldap (2.4.53+dfsg-1ubuntu6) hirsute; urgency=medium
+
+  * d/apparmor-profile: use abstractions/ssl_keys instead of manual rules,
+    allows letsencrypt to work. Thanks to Paul McEnery (LP: #1909748)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 04 Jan 2021 14:57:17 +0100
+
 openldap (2.4.53+dfsg-1ubuntu5) hirsute; urgency=medium
 
   * SECURITY UPDATE: assertion failure in Certificate List syntax