WARNING this is an alpha - NOT released targeted to fall 2023

AppArmor 4.0-alpha3 was released 2023-09-18.

Introduction

AppArmor 4.0 is a major new release of the AppArmor that is in development, these are not complete release notes of everything in alpha3 but just highlighting new or important developments

Apprmor 4.0 is a bridge release between older AppArmor 3.x policy and the newer AppArmor 4 style policy which introduces several new features that are not backwards compatible. As such AppArmor 4.0 will be a short lived release, and will not receive long term support. The following AppArmor 4.1 feature release is planned to be a regular release, please take this into account when including AppArmor 4.0 into a distro release. For questions around compatibility see the compatibility matrix.

These release notes cover changes between AppArmor-4.0~alpha2 and AppArmor-4.0~alpha3

Note

Some features will work with older kernels but many of the features in apparmor 4 with require a development kernel.
The kernel portion of the project is maintained and pushed separately.
AppArmor 4.0 contains all bug fixes and policy updates from apparmor 3.1
Some new features will not be fully supported in some utilities. In these cases it was decided that releasing a new feature earlier had more benefit than delaying it for full utility support. Please see the feature support matrix.

Obtaining the Release

There are two ways to obtain this release either through gitlab or a tarball in launchpad.

Important note: the gitlab release tarballs differ from the launchpad release tarballs. The launchpad release tarball has a couple processing steps already performed:

libapparmor autogen.sh is already done, meaning distros only need to use ./configure in their build setup
the docs for everything but libapparmor have already been built

gitlab

https://gitlab.com/apparmor/apparmor/-/releases/v4.0.0-alpha3

Launchpad

https://launchpad.net/apparmor/4.0/4.0.0-alpha3/+download/apparmor-4.0.0-alpha3.tar.gz
sha256sum: bcfdb558d04e1cf6947f55742e94290547e589a30c8624c62dfd3568b0f496a5
signature: https://launchpad.net/apparmor/4.0/4.0.0/+download/apparmor-4.0.0-alpha3.tar.gz.asc
signature sha256sum: 66a25aafc171d40863369c7fcfb70943b06540194df13cf975b144f0d1aeec2c

Highlighted new features in alpha 3

New Profile Flag

utils

aa-status
- fix json output
- separate error messages from regular output
apparmor development utilities (aa-logprof, ...)
- support all rule

Feature Matrix

Feature	policy extension	breaks 3.x	supported by utils	requires 4.x libapparmor	requires kernel support
interruptible flag	Y	Y ¹	N	N	Y ²
*kill.signal flag	Y	Y ¹	N	N	Y ²

If present in policy will cause previous versions of AppArmor to fail
Requires kernel support, policy can be downgraded to work on kernels that do not support.
Previous versions of AppArmor may not fail but will not behave correctly
Feature can be functionally provided by may not be exactly the same
If more than 12 transitions are used in a profile, AppArmor 3.x will fail
Will break older policy if variable is not defined. Variable can be manually defined in older parser.
AppArmor 3.x will not break but will use declared abi, instead of extending abi when a rule not in the abi is declared in policy.
These features if enabled will change unconfined's behavior but can be disabled with either a grub kernel boot parameter or sysctl depending on the kernel.
Does not allow any new rules but allows overlapping exec rules that would have been previously rejected.
If overlapping rules not supported by 3.x are used policy will break on 3.x and older environments
Tools will work but may not deal with overlapping rules correctly in some cases