Last commit made on 2018-10-04
Get this branch:
git clone -b ubuntu/trusty-updates https://git.launchpad.net/ubuntu/+source/apparmor
Members of Ubuntu Server Dev import team can upload to this branch. Log in for directions.

Branch merges

Branch information


Recent commits

c4148e2... by Jamie Strandboge on 2018-09-27

Import patches-unapplied version 2.10.95-0ubuntu2.6~14.04.4 to ubuntu/trusty-security

Imported using git-ubuntu import.

Changelog parent: 1a09a8d1146540e4c5507667eae390f05f354428

New changelog entries:
  * {,14.04-}lp1788929+1794848.patch:
    - disallow writes to thumbnailer dir (LP: #1788929)
    - disallow access to the dirs of private files (LP: #1794848)

1a09a8d... by Eric Desrochers on 2018-02-02

Import patches-unapplied version 2.10.95-0ubuntu2.6~14.04.3 to ubuntu/trusty-proposed

Imported using git-ubuntu import.

Changelog parent: 748e40e53baddd9a9e1896e4eef8384c029f2394

New changelog entries:
  * d/p/14.04-profiles-allow-seven-digit-pid-lp1717714.patch:
    - Renamed d/p/0001-Allow-seven-digit-pid.patch to mirror other
      profiles-14.04 patches naming pattern.
    - Modify the existing/renamed patch to use the dir that should be use to
      patch a profile. profiles-14.04/ should be use instead of profiles/
      which is not use. (LP: #1717714)

748e40e... by Seyeong Kim on 2018-01-08

Import patches-unapplied version 2.10.95-0ubuntu2.6~14.04.2 to ubuntu/trusty-proposed

Imported using git-ubuntu import.

Changelog parent: 513804c84191dea351567e5147678cfc036aad3f

New changelog entries:
  * d/p/0001-Allow-seven-digit-pid.patch:
    On 64bit systems, /proc/sys/kernel/pid_max can be set to PID_MAX_LIMIT,
    (2^22), which results in seven digit pids. Adjust the @{PID} variable in
    tunables/global to accept this. (LP: #1717714)

513804c... by Tyler Hicks on 2017-03-16

Import patches-unapplied version 2.10.95-0ubuntu2.6~14.04.1 to ubuntu/trusty-security

Imported using git-ubuntu import.

Changelog parent: 6ff5ebabab946dc6bf56104fc8d7d3f51a136be1

New changelog entries:
  * SECURITY UPDATE: Merge from xenial-security to get fix for CVE-2017-6507
  * debian/apparmor.postrm: Ensure that a purge of the apparmor package does
    not fail if the /var/lib/apparmor/profiles or /var/lib/apparmor
    directories do not exist. This purge operation should be considered
    successful in that situation. (LP: #1661406)
  * SECURITY UPDATE: Don't unload unknown profiles during package
    configuration or when restarting the apparmor init script or upstart job
    as this could leave processes unconfined (LP: #1668892)
    - debian/apparmor.postinst, debian/apparmor.init, debian/apparmor.upstart:
      Remove calls to unload_obsolete_profiles()
    - debian/patches/utils-add-aa-remove-unknown.patch,
      debian/apparmor.install debian/apparmor.manpages: Include a new utility,
      aa-remove-unknown, which can be used to unload unknown profiles
    - CVE-2017-6507

6ff5eba... by Tyler Hicks on 2016-11-30

Import patches-unapplied version 2.10.95-0ubuntu2.5~14.04.1 to ubuntu/trusty-proposed

Imported using git-ubuntu import.

Changelog parent: a684737ee189a0da0382ec8f63eee6c99766d2f9

New changelog entries:
  * Bring apparmor 2.10.95-0ubuntu2.5, from Ubuntu 16.04, to Ubuntu 14.04.
    - This allows for proper snap confinement on Ubuntu 14.04 when using the
      hardware enablement kernel (LP: #1641243)
  * Changes made on top of 2.10.95-0ubuntu2.5:
    - debian/apparmor.upstart: Remove the upstart job and continue using the
      init script in 14.04
    - debian/apparmor.postinst, debian/apparmor-profiles.postinst,
      debian/apparmor-profiles.postrm, debian/rules: Revert to using
      invoke-rc.d to load the profiles, rather than reloading them directly,
      since 14.04 will continue using the init script rather than the upstart
    - debian/apparmor.init, debian/lib/apparmor/functions,
      debian/apparmor.postinst, debian/apparmor.postrm: Remove functionality
      dealing with AppArmor policy in system image based environments since
      this 14.04 package will not need to handle such environments. This
      removes the handle_system_policy_package_updates(),
      compare_previous_version(), compare_and_save_debsums() functions and
      their callers.
    - debian/apparmor.init: Continue using running-in-container since
      systemd-detect-virt doesn't exist on 14.04
    - debian/lib/apparmor/functions, debian/apparmor.init: Remove the
      is_container_with_internal_policy() function and adjust its call sites
      in apparmor.init so that AppArmor policy is not loaded inside of 14.04
      LXD containers (avoids bug #1641236)
    - debian/lib/apparmor/profile-load, debian/apparmor.install: Remove
      profile-load as upstart's apparmor-profile-load is used in 14.04
    - debian/patches/libapparmor-mention-dbus-method-in-getcon-man.patch:
      Continue applying this patch since the dbus version in 14.04 isn't new
      enough to support fetching the AppArmor context from
    - debian/patches/libapparmor-force-libtoolize-replacement.patch: Force
      libtoolize to replace existing files to fix a libapparmor FTBFS issue on
    - debian/control: Retain the original 14.04 Breaks and ignore the new
      Breaks from 2.10.95-0ubuntu2.5 since they were put in place as part of
      the enablement of UNIX domain socket mediation. They're not needed in
      this upload since UNIX domain socket mediation is disabled by default so
      updates to the profiles included in those packages are not needed.
    - Preserve the profiles and abstractions from 14.04's
      2.8.95~2430-0ubuntu5.3 apparmor package by recreating them in the
      top-level profiles-14.04/ directory of the source. They'll be installed
      to debian/tmp/etc/apparmor.d/ during the build process and then to
      /etc/apparmor.d/ on package install so that there are no changes to the
      shipped profiles or abstractions. The abstractions from
      2.10.95-0ubuntu2.5 will be installed into
      debian/tmp/snap/etc/apparmor.d/ during the build process and then into
      /etc/apparmor.d/snap/abstractions/ on package install for use with snap
      confinement. Snap confinement profiles, which includes AppArmor profiles
      loaded by snapd and profiles loaded by snaps that are allowed to manage
      AppArmor policy, will use the snap abstractions. All other AppArmor
      profiles will continue to use the 14.04 abstractions.
      - debian/rules: Adjust for new profiles-14.04/ directory
      - debian/apparmor-profiles.install: Adjust to install the profiles that
        were installed in the 2.8.95~2430-0ubuntu5.3 package
      - debian/apparmor.install: Install the abstractions from the
        2.10.95-0ubuntu2.5 package into /etc/apparmor.d/snap/abstractions/
      - debian/patches/14.04-profiles.patch: Preserve the 14.04 profiles and
        abstractions from the 2.8.95~2430-0ubuntu5.3 apparmor package.
      - debian/patches/conditionalize-post-release-features.patch: Disable new
        mediation features, implemented after the Ubuntu 14.04 release, unless
        the profile is for snap confinement. If the profile is for snap
        confinement, the abstractions from /etc/apparmor.d/snap/abstractions
        will be used and all of the mediation features will be enabled.
    - 14.04-add-chromium-browser.patch,
      14.04-profiles-adjust_X_for_lightdm-lp1339727.patch: Import all of the
      patches, from 14.04's 2.8.95~2430-0ubuntu5.3 apparmor package, which
      patched profiles/ and adjust them to patch profiles-14.04/ instead.
    - debian/patches/revert-r2550-and-r2551.patch: Revert two upstream changes
      to mod_apparmor which could potentially regress existing users of
      mod_apparmor in 14.04. These upstream changes are not appropriate for an

a684737... by Tyler Hicks on 2016-10-07

Import patches-unapplied version 2.10.95-0ubuntu2.5 to ubuntu/xenial-proposed

Imported using git-ubuntu import.

Changelog parent: 2a90832d880fe81ae63db1a5ab231862572cdcbc

New changelog entries:
  * debian/lib/apparmor/functions, debian/apparmor.init,
    debian/apparmor.service, debian/apparmor.upstart,
    debian/lib/apparmor/profile-load: Adjust the checks that previously kept
    AppArmor policy from being loaded while booting a container. Now we
    attempt to load policy if we're in a LXD or LXC managed container that is
    using profile stacking inside of a policy namespace. (LP: #1628285)
  * Fix regression tests for stacking so that the kernel SRU process is not
    interrupted by failing tests whenever the AppArmor stacking features are
    backported from the 16.10 kernel or when the 16.04 LTS Enablement Stack
    receives a 4.8 or newer kernel
    - debian/patches/r3509-tests-fix-exec_stack-errors-1.patch: Fix the
      exec_stack.sh test when running on 4.8 or newer kernels (LP: #1628745)
    - debian/patches/r3558-tests-fix-exec_stack-errors-2.patch: Adjust the
      exec_stack.sh fix mentioned above to more accurately test kernels older
      than 4.8 (LP: #1630069)
    - debian/patches/allow-stacking-tests-to-use-system.patch: Apply this
      patch earlier in the series, as to match when it was committed upstream,
      so that the above two patches can be cherry-picked from lp:apparmor

2a90832... by Tyler Hicks on 2016-09-28

Import patches-unapplied version 2.10.95-0ubuntu2.4 to ubuntu/xenial-proposed

Imported using git-ubuntu import.

Changelog parent: 034e81484eb19f8f11378d1cc9ecdb3f4b4a4f86

New changelog entries:
  * debian/patches/r3505-tests-fix-stacking-mode-checks.patch: Fix failing
    regression tests so that the kernel SRU process is not interrupted by
    failing stackonexec.sh and stackprofile.sh tests (LP: #1628295)

034e814... by Tyler Hicks on 2016-08-26

Import patches-unapplied version 2.10.95-0ubuntu2.3 to ubuntu/xenial-proposed

Imported using git-ubuntu import.

Changelog parent: c0cebdf5c3ec0dabe6c9f3891c879540b9c2735d

New changelog entries:
  * debian/patches/allow-access-to-ibus-socket.patch: Adjust the ibus
    abstraction to allow access to the abstract UNIX domain socket location
    used in Ubuntu. (LP: #1580463)
  * debian/lib/apparmor/functions: Quiet the "Files ... and ... differ"
    output, during the update process, which was printed by diff. This message
    left users concerned since it mentioned md5sums files without being clear
    about what was happening. (LP: #1614215)

c0cebdf... by Tyler Hicks on 2016-08-01

Import patches-unapplied version 2.10.95-0ubuntu2.2 to ubuntu/xenial-proposed

Imported using git-ubuntu import.

Changelog parent: 1069880e5cb078096a93437fbd50282de9c80e03

New changelog entries:
  * r3498-r3499-ignore-net-events-that-look-like-file-events.patch: Prevent an
    aa-logprof crash by ignoring file events that contains send *and* receive
    in the request mask. This is an improvement to the previous fix that only
    addressed events that contained send *or* receive.
    (LP: #1577051, LP: #1582374)
    - debian/rules: Create a new empty file, needed for the test added by this
      patch, since quilt is unable to do so.

1069880... by Tyler Hicks on 2016-07-28

Import patches-unapplied version 2.10.95-0ubuntu2.1 to ubuntu/xenial-proposed

Imported using git-ubuntu import.

Changelog parent: 786f15391477bb5b4c5eb457061261c9d04407d2

New changelog entries:
  * debian/patches/r3460-ignore-file-events-with-send-or-receive-request.patch:
    Prevent an aa-logprof crash by ignoring file events that contains
    send or receive in the request mask. (LP: #1577051, LP: #1582374)
  * debian/patches/r3463-r3475-change-profile-exec-modes.patch: Allow policy
    authors to specify if the environment should scrubbed during exec
    transitions allowed by a change_profile rule. (LP: #1584069)
  * debian/patches/r3478-make-overlapping-safe-and-unsafe-rules-conflict.patch:
    Make sure that multiple change_profile rules with overlapping safe and
    unsafe exec modes conflict when they share the same exec conditional
    (LP: #1588069)
  * debian/patches/r3488-r3489-fix-racy-onexec-test.patch: Fix racy regression
    test so that the kernel SRU process is not interrupted by the onexec.sh
    periodically failing. (LP: #1528230)
  * debian/patches/r3490-utils-handle-change-profile-exec-modes.patch: Update
    the Python utilities to handle the new exec mode keywords in
    change_profile rules. (LP: #1584069)
  * debian/patches/r3492-allow-dbus-user-session-path.patch: Allow read/write
    access to the dbus-user-session socket file in profiles that include the
    dbus-session-strict abstraction. (LP: #1604872)