8 Release_Notes_2.11.3

Christian Boltz edited this page 2019-06-18 23:35:35 +02:00

Table of Contents

• Introduction
• Obtaining the Release
• Changes in This Release
• Build Infrastructure
• Policy Compiler (a.k.a apparmor_parser)
• Init
• Utils
• Policy
• Tests
• Documentation

Introduction

AppArmor 2.11.3 is a maintenance release of the user space components of the AppArmor security project. The kernel portion of the project is maintained and pushed separately.

This version of the userspace should work with all kernel versions from 2.6.15 and later (some earlier version of the kernel if they have the apparmor patches applied). And supports features released in the 4.18 kernel and ubuntu 18.04 kernel.

AppArmor 2.11.3 was released 2019-06-18.

Obtaining the Release

These release notes cover all changes between 2.11.2 (5afe0f8889) and 2.11.3 (119e761bab) apparmor-2.11 branch.

Tarball

• https://launchpad.net/apparmor/2.11/2.11.3/+download/apparmor-2.11.3.tar.gz
• sha256sum: 17bcf767925ef4df00bfb20b940e2206fae6e4d959b57398874cd1f1a8d090f0
• signature: https://launchpad.net/apparmor/2.11/2.11.3/+download/apparmor-2.11.3.tar.gz.asc

Changes in This Release

Build Infrastructure

• add files to .gitignore: swig auto generated files for ruby (MR366)
• fix libapparmor swig 4 failure 'aa_log_record' object has no attribute '__getattr__' (BUG33)

Policy Compiler (a.k.a apparmor_parser)

• fix parsing of target profile NAME in directed transitions “px -> NAME" (MR334)
• clean up error handling (dbug921866, LP1815294)

Init

• ensure error value is returned correctly (MR352)

Utils

• logprof/genprof:
  • don't drop later events when user selects to deny a hat (MR378)

Policy

• Profiles

  • dovecot
    • allow FD passing between dovecot and dovecot's anvil (MR336)
    • allow chroot'ing the auth processes (MR336)
    • let dovecot/anvil rw the auth-penalty socket (MR336)
    • auth processes need to read from postfix auth socket (MR336)
    • add abstractions/ssl_certs to lmtp (MR336)
    • allow master to use SIGTERM on children that are slow to die (MR357)
  • identd: allow network netlink dgram (MR353)

• Abstractions

  • fonts:
    • allow to read conf-avail dir itself (MR165)
    • add various openSUSE-specific font config directories (MR309)
  • nameservice: allow access to /run/netconfig/resolv.conf (boo1097370)
  • qt5-compose-cache-write: fix anonymous shared memory access (MR301)
  • qt5-settings-write: fix anonymous shared memory access (MR302)
  • ssl_certs,keys: add support for libdehydrated in /var/lib/ (MR299)

Tests

• fix mount test to use next available loop device (MR379)

Documentation

• drop to option for link rules from the apparmor.d manpage (MR368)