8 Release_Notes_2.13.7

John Johansen edited this page 2022-11-21 23:47:10 +00:00

Table of Contents

• Introduction
• Obtaining the Release
• gitlab release
• Launchpad Tarball
• Changes in this Release
• Libapparmor
• Policy Compiler (a.k.a apparmor_parser)
• Utils
• apparmor.vim
• Policy
• Abstractions
• Profiles
• Tests
• Documentation

AppArmor 2.13.7 was released 2022-11-21.

Introduction

AppArmor 2.13.7 is a maintenance release of the user space components of the AppArmor security project. The kernel portion of the project is maintained and pushed separately.

This version of the userspace should work with all kernel versions from 2.6.15 and later (some earlier version of the kernel if they have the apparmor patches applied). And supports features released in the 4.18 kernel and ubuntu 18.04 kernel with the apparmor 3 development patches.

Obtaining the Release

There are two ways to obtain this release either through gitlab or a tarball in launchpad. Important note: the gitlab release tarballs: Differ from the launchpad release tarballs. The launchpad release tarball has a couple processing steps already performed:

• libapparmor autogen.sh is already done, meaning distros only need to use ./configure in their build setup
• the docs for everything but libapparmor have already been built

gitlab release

• https://gitlab.com/apparmor/apparmor/-/releases/v2.13.7

Launchpad Tarball

• https://launchpad.net/apparmor/2.13/2.13.7/+download/apparmor-2.13.7.tar.gz
• sha256sum: 8c6d19ffb8ba13b776f7922a144a7bd7f221592dacec44e51485a784ddd20e09
• signature: https://launchpad.net/apparmor/2.13/2.13.7/+download/apparmor-2.13.7.tar.gz.asc

Changes in this Release

These release notes cover all changes between 2.13.6 (c16fff8cb4) and 2.137 (b51a2d271d) on the apparmor-2.13 branch.

Libapparmor

• Support setuptools >= 61.2 (MR:910, HUBMR:3258/commits/1c23f5e1e4b18b50081cbabb2dea22bf345f5894)
• remove deprecation warning for distutils (MR:908)
• fix building with link time optimization (lto) (MR:831, AABUG:214)
• look up python-config using AC_PATH_TOOL (MR:729, debug984582)
• Do not abuse AC_CHECK_FILE (MR:728, debug984582)

Policy Compiler (a.k.a apparmor_parser)

• fix rlimit parsing (MR:803)
• fix cache time stamp check to include dir time stamps (MR:760)
• fix filter slashes for link targets (MR:723, AABUG:153)
• fix rule downgrade for unix rules (MR:700, BOO:1180766)
• fix --jobs so job scaling is applied correctly (MR:703)

Utils

• Add 'mctp' network domain keyword (MR:911)
• Support setuptools >= 61.2 (MR:910, HUBMR:3258/commits/1c23f5e1e4b18b50081cbabb2dea22bf345f5894)
• Use string startswith() and endswith() methods (MR:931)
• Set (instead of compare) exresult (MR:907)
• support new versions of python (MR:795, Fixes: AABUG:193)
• aa-remove-unknown
  • abort on parser failure (MR:859)

apparmor.vim

• add support for abi rules (MR:690)

Policy

Abstractions

• avahi
  • Add missing /proc permissions (MR:811, AABUG:203)
• base
  • Allow access to possible cpus for glibc-2.36 (AABUG:267, LP:1989073)
• mesa
  • Update permissions (MR:879)
• openssl:
  • allow /etc/ssl/{engdef,engines}.d/ (MR:818)
• php
  • support PHP 8 (MR:755, BOO:1186267)
• python
  • update for python 3.10 (MR:783, AABUG:187)
• private-files-strict
  • add new deny path for kwallet (used in KDE 5) (MR:704)
• snap_browsers
  • new abstraction (MR:863)
  • update permissions (MR:877)
• ubuntu-helpers
  • Fix: Opening links with Chrome (MR:830)
• ubuntu-browsers.d/user-files
  • add new deny path for kwallet (used in KDE 5) (MR:704)
• video
  • fix sys rule for video4linux (MR:791)
• wutmp
  • Add missing rule in wutmp abstraction (MR:724, AABUG:152)

Profiles

• dhclient: allow setting task comm name (LP:1918410)
• dhcpd
  • add rule for port_range (MR:726), LP:1901373)
• dnsmasq
  • Add missing r permissions for libvirt_leaseshelper (MR:905, BOO:1202161)
• dovecot
  • Allow use of all signals (MR:865)
  • allow Prometheus metrics end-point in dovecot/stats (MR:776)
• firefox
  • Add support for widevine DRM (MR:684)
• nscd
  • fix conflict with systemd-homed (MR:707, AABUG:145)
• python
  • update for python 3.10 (MR:783, AABUG:187)
• samba
  • allow reading openssl.cnf (MR:862, BOO:1195463#c10)
• syslog-ng
  • allow reading *.journal in flatter directory structure (MR:932)

Tests

• fix i18n.sh regression test on arm64 (MR:765, LP:1932331)

Documentation

• fix typos, punctuation, ..(MR:789, AABUG:192)