1 IRC_meeting_2023 08 08

John Johansen edited this page 2023-08-08 18:48:35 +00:00

(11:01:09 AM) jjohansen: georgiag, cboltz, sarnold, sbeattie, anyone/everyone else meeting time
(11:01:20 AM) ***georgiag is here :)
(11:01:26 AM) ***cboltz hides
(11:05:08 AM) ***sbeattie is here
(11:05:28 AM) jjohansen: alright lets get started
(11:06:03 AM) ***sarnold hides
(11:06:10 AM) jjohansen: we don't have anything on the agenda
(11:06:23 AM) jjohansen: so 4.0 status will be first up
(11:06:36 AM) cboltz: sarnold: you can't, I already occupied the hiding-place
(11:06:58 AM) sarnold: HEY YOU GUYS I FOUND CBOLTZ
(11:07:13 AM) jjohansen: we are currently trying to squash some bugs, that are causing test regressions, so we can land the next round of patches and release alpha2
(11:08:05 AM) jjohansen: nice job
(11:08:38 AM) jjohansen: we might roll an alpha3 on the weekend/early next week
(11:09:44 AM) jjohansen: but it will be short lived because unless we absolutely can't the beta will be rolled late on the 16th or early on the 17th
(11:09:54 AM) jjohansen: so get patches in please
(11:11:54 AM) cboltz: good point - what about the tunables/foo.d MR? ;-)
(11:12:40 AM) cboltz: we have that concept also in abstractions (and maybe it would even be a good replacement for local/* in profiles)
(11:12:44 AM) ***jjohansen gets his big stick to encourage cboltz back into hiding
(11:13:13 AM) cboltz: and such include files have turned out to be useful in lots of places - not only when it comes to AppArmor profiles
(11:13:21 AM) cboltz: jjohansen: too late ;-)
(11:13:23 AM) jjohansen: sarnold: you need to make room for cbolta
(11:14:01 AM) jjohansen: sigh s/cbolta/cboltz/
(11:14:22 AM) ***jjohansen can still try to put the genie back in the bottle
(11:15:26 AM) cboltz: better think about a way to stop me from adding $profile.d includes to all profiles *eg*
(11:15:46 AM) earthundead left the room (quit: Remote host closed the connection).
(11:16:11 AM) jjohansen: cboltz: I know you like it, I won't ack it or merge it. I really dislike the whole include foo.d and would like to roll it back completely. But as that being said as stated I won't nak it either
(11:17:02 AM) earthundead [~earthunde@188.170.74.109] entered the room.
(11:17:28 AM) cboltz: ok, so since the MR is more than a week old - acked-by: timeout?
(11:17:30 AM) cboltz: ;-))
(11:18:16 AM) sarnold: I don't love it but it seems to be a useful way for folks to cope with mediocre packaging tools :(
(11:18:41 AM) Talkless [~Talkless@mail.dargis.net] entered the room.
(11:19:14 AM) cboltz: right, and there might be more advantages than the obvious "avoiding *.rpmnew"
(11:19:55 AM) cboltz: for example, a package could install a drop-in file to extend a variable without causing a conflict with the apparmor-abstractions package
(11:20:02 AM) jjohansen: I still think if you want to avoid .rpmnew an overlay is the way to go
(11:20:32 AM) cboltz: using foo.d doesn't stop us from using an overlay - they are both useful
(11:20:33 AM) jjohansen: yes, the whole avoiding the conflict is the problem
(11:20:52 AM) cboltz: think of   systemctl edit foo   vs.    systemctl edit -- full foo
(11:21:02 AM) jjohansen: policy changes without some kind of review are a problem ...
(11:21:37 AM) jjohansen: you are not helping your cause :)
(11:21:38 AM) cboltz: agreed, but OTOH if a package ships a profile, it also doesn't get reviewed
(11:22:17 AM) jjohansen: well yes, but in that case the assumption is the developer or maintainer has put some work into the profile
(11:22:19 AM) cboltz: (but if you really want, you could enforce a review for packages that extend abstractions or tunables - at least the openSUSE tooling could be extended in this way quite easily)
(11:22:28 AM) jjohansen: big assumption I know
(11:23:01 AM) cboltz: well, if a package ships a profile, then that assumption usually isn't that wrong
(11:23:14 AM) cboltz: maybe the profile won't be perfect, but at least good enough
(11:24:14 AM) sarnold: one problem with "use an overlay instead" is that I don't know what I'd search for to learn enough to do it
(11:25:18 AM) jjohansen: but you know enough to search for how to edit/extend an apparmor profile?
(11:25:38 AM) jjohansen: I don't see it being that different
(11:26:59 AM) sarnold: yeah, maybe that's unique to me, being ancient, perhaps someone newer to apparmor would find either one amenable
(11:27:47 AM) jjohansen: anyways, I am not going to die on this hill, just bitch, moan and complain
(11:27:53 AM) sarnold: :)
(11:29:26 AM) jjohansen: this is getting into bikeshedding territory
(11:29:51 AM) jjohansen: do we have anything else to discuss?
(11:30:17 AM) cboltz: somewhat related from apparmor.d: https://github.com/roddhjav/apparmor.d/pull/189
(11:30:52 AM) cboltz: (which, BTW, would also benefit from tunables/foo.d/ ;-)
(11:31:36 AM) cboltz: I guess the most interesting part of this PR is the actual tunables addition. https://github.com/roddhjav/apparmor.d/pull/189/files#diff-d361a77ee5461975e224e47f89eb0af2f5a267544c19075e9dd18a9279656d49
(11:33:42 AM) jjohansen: cboltz: so I just haven't had time to look at it, from a quick glance I don't have any objections to the new tunnables
(11:33:56 AM) jjohansen: but I need to spend more time looking at it to ack it
(11:34:56 AM) jjohansen: something, something, if someone else has time ...
(11:35:27 AM) jjohansen: I do plan on trying to get to more of the MRs today, I would like to get what we can into the next alpha
(11:35:41 AM) jjohansen: but, debugging has not been going well ...
(11:36:59 AM) jjohansen: oh, I also plan to get to outstanding upstream kernel patches first, I need to get them into apparmor-next so they can get into linux-next ...
(11:37:34 AM) jjohansen: patches for the 6.6 kernel unless they are a critical bug fix need to land this week
(11:38:04 AM) jjohansen: do we have anything else to discuss?
(11:39:42 AM) cboltz: I could ask for the status of various WIP MRs, but I guess giving you some time to actually work on them is probably more useful ;-)
(11:41:16 AM) jjohansen: I think they all are still WIP, my focus currently has been the gnarly changes to the permissions model so we have access to extended permissions
(11:41:45 AM) jjohansen: fixed dominance ...
(11:42:24 AM) cboltz: two easier questions:
(11:43:00 AM) cboltz: does !1079 need to be backported, or is it only needed in master?
(11:43:25 AM) cboltz: should we backport !1076 (firefox profile)?
(11:44:29 AM) jjohansen: cboltz: it needs to be backport, I just haven't gotten to doing it yet
(11:47:56 AM) jjohansen: alright, next irc meeting is tuesday Sept 12, 2023. We can make a call about whether to skip it closer to then
(11:48:07 AM) jjohansen: thanks everyone meeting adjourned