Merge ~penguin359/ubuntu/+source/apparmor:lp2110212-fix-lsusb-apparmor-profile-plucky into ubuntu/+source/apparmor:ubuntu/plucky-devel

[Loren M. Lang]

This cherry-picks the patch for the Apparmor profile issue with lsusb to Plucky. This is to resolve the issue documented in LP: #2110212.

Unmerged commits

67f293a... by Loren M. Lang on 2025-11-27

4.1.0~beta5-0ubuntu14.3 (patches unapplied)

Cherry-picked patch to fix lsusb apparmor profile

7924fe2... by Loren M. Lang on 2025-11-27

[PATCH] profiles: add additional rules needed for lsusb under sudo +

diff --git a/debian/changelog b/debian/changelog
index ea809d8..0f558d5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+apparmor (4.1.0~beta5-0ubuntu14.3) plucky; urgency=medium
+
+  * Non-maintainer upload.
+  * Add a patch to fix lsblk and --tree (LP: #2110212):
+    - d/p/u/lsblk_sudo_and_tree.patch
+
+ -- Loren M. Lang <[e-mail]>  Thu, 27 Nov 2025 02:09:37 -0800
+
 apparmor (4.1.0~beta5-0ubuntu14.2) plucky; urgency=medium
 
   * profiles: make /sys/devices PCI paths hex-aware (LP: #2115234)
diff --git a/debian/patches/series b/debian/patches/series
index ef60b2e..8d4af23 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -76,3 +76,4 @@ ubuntu/regression-verify-documented-mount-flag-behavior.patch
 ubuntu/parser-fix-handling-of-norelatime-mount-rule-flag.patch
 ubuntu/profiles-give-iotop-c-additional-accesses.patch
 ubuntu/profiles_pci_hex_mr_1725.patch
+ubuntu/lsblk_sudo_and_tree.patch
diff --git a/debian/patches/ubuntu/lsblk_sudo_and_tree.patch b/debian/patches/ubuntu/lsblk_sudo_and_tree.patch
new file mode 100644
index 0000000..0f144ac
--- /dev/null
+++ b/debian/patches/ubuntu/lsblk_sudo_and_tree.patch
@@ -0,0 +1,59 @@
+From 9f700040587e69a5cc272ab607a12e7227404737 Mon Sep 17 00:00:00 2001
+From: Ryan Lee <[e-mail]>
+Date: Mon, 9 Jun 2025 12:56:36 -0700
+Subject: [PATCH] profiles: add additional rules needed for lsusb under sudo +
+ other flags
+
+Fixes: https://bugs.launchpad.net/ubuntu/+source/usbutils/+bug/2110212
+Signed-off-by: Ryan Lee <[e-mail]>
+---
+ profiles/apparmor.d/lsusb | 31 +++++++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+Index: b/profiles/apparmor.d/lsusb
+===================================================================
+--- a/profiles/apparmor.d/lsusb	2025-06-17 17:29:51.067827898 -0700
++++ b/profiles/apparmor.d/lsusb	2025-06-17 17:29:51.064827909 -0700
+@@ -20,6 +20,10 @@
+ 
+   network netlink raw,
+ 
++  # Needed for additional information gathered under sudo
++  capability net_admin,
++  /dev/bus/usb/@{d}@{d}@{d}/@{d}@{d}@{d} rw,
++
+   /dev/ r,
+   /dev/bus/usb/ r,
+   @{run}/udev/data/*usb:* r,
+@@ -37,6 +41,31 @@
+   @{sys}/devices/**/usb[0-9]**/manufacturer r,
+   @{sys}/devices/**/usb[0-9]**/product r,
+   @{sys}/devices/**/usb[0-9]**/serial r,
++  # needed for --tree
++  @{sys}/devices/**/usb[0-9]**/bAlternateSetting r,
++  @{sys}/devices/**/usb[0-9]**/bInterfaceClass r,
++  @{sys}/devices/**/usb[0-9]**/bInterfaceNumber r,
++  @{sys}/devices/**/usb[0-9]**/bInterfaceProtocol r,
++  @{sys}/devices/**/usb[0-9]**/bInterfaceSubClass r,
++  @{sys}/devices/**/usb[0-9]**/bNumEndpoints r,
++  @{sys}/devices/**/usb[0-9]**/bConfigurationValue r,
++  @{sys}/devices/**/usb[0-9]**/bDeviceClass r,
++  @{sys}/devices/**/usb[0-9]**/bDeviceProtocol r,
++  @{sys}/devices/**/usb[0-9]**/bDeviceSubClass r,
++  @{sys}/devices/**/usb[0-9]**/bMaxPacketSize0 r,
++  @{sys}/devices/**/usb[0-9]**/bNumConfigurations r,
++  @{sys}/devices/**/usb[0-9]**/bNumInterfaces r,
++  @{sys}/devices/**/usb[0-9]**/bcdDevice r,
++  @{sys}/devices/**/usb[0-9]**/bmAttributes r,
++  @{sys}/devices/**/usb[0-9]**/configuration r,
++  @{sys}/devices/**/usb[0-9]**/idProduct r,
++  @{sys}/devices/**/usb[0-9]**/idVendor r,
++  @{sys}/devices/**/usb[0-9]**/maxchild r,
++  @{sys}/devices/**/usb[0-9]**/rx_lanes r,
++  @{sys}/devices/**/usb[0-9]**/tx_lanes r,
++  # Needed for --tree -v
++  @{sys}/devices/**/usb[0-9]**/bMaxPower r,
++  @{sys}/devices/**/usb[0-9]**/version r,
+ 
+   include if exists <local/lsusb>
+ }