10 Release_Notes_3.0.1

John Johansen edited this page 2020-12-02 18:07:09 +00:00

Table of Contents

• Introduction
• Highlighted fixes or improvements
• Obtaining the Release
• gitlab
• Launchpad
• Changes in this Release
• Library
• Policy Compiler (a.k.a apparmor_parser)
• aa_status
• aa-notify
• Utils
• Policy
• abstractions
• profiles
• Documentation
• Tests
• Note

AppArmor 3.0.1 was released 2020-12-02.

Introduction

AppArmor 3.0.1 is a maintenance release of the user space components of the AppArmor security project. The kernel portion of the project is maintained and pushed separately.

This version of the userspace should work with all kernel versions from 2.6.15 and later (some earlier version of the kernel if they have the apparmor patches applied).

The kernel portion of the project is maintained and pushed separately.

Highlighted fixes or improvements

• Adds support for capability checkpoint_restore for the 5.9 and later kernels

Obtaining the Release

There are two ways to obtain this release either through gitlab or a tarball in launchpad. Important note: the gitlab release tarballs: Differ from the launchpad release tarballs. The launchpad release tarball has a couple processing steps already performed:

• libapparmor autogen.sh is already done, meaning distros only need to use ./configure in their build setup
• the docs for everything but libapparmor have already been built

gitlab

• https://gitlab.com/apparmor/apparmor/-/releases/v3.0.1

Launchpad

• https://launchpad.net/apparmor/3.0/3.0.1/+download/apparmor-3.0.1.tar.gz
• sha256sum: 8fada772d9a60989525594346d9aa22af938daafc1781adce9a1acb3c75bdf24
• signature: https://launchpad.net/apparmor/3.0/3.0.1/+download/apparmor-3.0.1.tar.gz.asc

Changes in this Release

These release notes cover all changes between 3.0 (5d51483bfe) and 3.0.1 (b0f08aa9d6) apparmor-3.0 branch.

Library

• fix failure in procattr accesses due to domain change (MR:681, AABUG:131)
• add missing include for socklen_t (MR:642)
• add _aa_asprintf to private symbols (MR:643)
• add aa_features_new_from_file to public symbols (MR:643)

Policy Compiler (a.k.a apparmor_parser)

• add support for capability checkpoint_restore in the policy language.
• Add support for CAP_CHECKPOINT_RESTORE (MR:654)
• Fix warning message when complain mode is forced (MR:649, LP:1899218)
• fix parser.conf commenting on pinning an abi (MR:648)
• dont force host cpp to detect reallocarray (MR:647)

aa_status

• Fix build issue with musl (MR:647)

aa-notify

• don't crash if the logfile is not present due to rotation (MR:688, AABUG:130)
• Stop aa-notify from exit after 100s of polling (MR:660, AABUG:126)
• Skip test if it can not access /var/log/wtmp (MR:641, AABUG:120)

Utils

• add capability checkpoint_restore to the severity db (MR:656)
• check if abstractions exist (MR:683, BOO:1178527)
• aa-autodep: load abstractions on start (MR:682, BOO:1178527)
• Fix hotkey conflict in utils de.po and id.po (MR:675)
• fix failure of make -C profiles check-logprof (MR:663, AABUG:36)
• split linting with PYFLAKES into a separate target. (AABUG:121)

Policy

abstractions

• fonts
  • Add Fontmatrix support (MR:657)
• mesa
  • tightens cache location and add fallback (AABUG:91)
• ubuntu-browsers
  • Add support for brave browser (MR:667)
  • Adjust ubuntu-integration to use abstractions/exo-open (MR:666)
• X
  • Allow (only) reading X compose cache (MR:685)
  • make x11 socket writable again (MR:664)
  • adjust for new ICEauthority path in run (MR:668)

profiles

• dhclient-script
  • Fix invalid Pux (should be PUx) permissions (MR:676)
  • Fix dhclient and dhclient-script profiles to work on debian buster (MR:645)
• dovecot
  • allow reading dh.pem (MR:671, debug10)
  • allow kill signal (MR:671)
• nscd
  • Fix service fails on Arch Linux (MR:651, AABUG:124)

Documentation

• Fix typos in man pages (MR:669)
• apparmor_xattrs.7: fix whatis entry (MR:669)
• fix manpage order (MR:646)

Tests

• regression
  • Fix aa_policy_cache to use correct config file (MR:653)
  • Fix regression tests when using in tree parser (MR:653)

Note

There is a semantic change in the 4.8 kernel (commit 9f834ec18defc369d73ccf9e87a2790bfa05bf46) that affects apparmor policy enforcement. Specifically it affects when the m permission bit is checked for elf binary executables. Policy and tests within apparmor 2.12 and later have been updated to support running on pre 4.8 and 4.8+ kernels.