10 Release_Notes_4.0 beta1

John Johansen edited this page 2024-03-01 22:40:38 +00:00

Table of Contents

• WARNING this is a beta - NOT a final release
• Introduction
• Notes
• Misc
• What happened to feature X?
• Features
• policy compiler (aka apparmor_parser)
• bin-utils
• Utils
• Policy
• Abstractions
• Profiles
• Unconfined Profiles
• Infrastructure
• Tests
• Regression testing

WARNING this is a beta - NOT a final release

AppArmor 4.0-beta1 was released 2024-02-29.

Introduction

AppArmor 4.0 is a major new release of the AppArmor that is in development, these are not complete release notes of everything in beta1 but just highlighting new or important developments

Apprmor 4.0 is a bridge release between older AppArmor 3.x policy and the newer AppArmor 4 style policy which introduces several new features that are not backwards compatible. As such AppArmor 4.0 will be a short lived release, and will not receive long term support. The following AppArmor 4.1 feature release is planned to be a regular release, please take this into account when including AppArmor 4.0 into a distro release. For questions around compatibility see the compatibility matrix.

These release notes cover changes between AppArmor-4.0~alpha4 and AppArmor-4.0~beta1

Notes

• new dependency build dependency ** autoconf-archive **

Misc

• Some features will work with older kernels but many of the features in apparmor 4 with require a development kernel.
• The kernel portion of the project is maintained and pushed separately.
• AppArmor 4.0 contains all bug fixes and policy updates from apparmor 3.1
• Some new features will not be fully supported in some utilities. In these cases it was decided that releasing a new feature earlier had more benefit than delaying it for full utility support. Please see the feature support matrix.

What happened to feature X?

Unfortunately we just ran out of time, and instead of delaying AppArmor 4.0 yet again we decided that it would be better to have a reduced feature set release now. The many features that did not make this release are still in progress and are now targeted for the AppArmor 4.1 release in the autumn.

Features

policy compiler (aka apparmor_parser)

• Experimental
  • Fine grained IPv4 and IPv6 network mediation (MR:1160)
    
    • Requires use of experimental kernel.
    • Unsupported and evolving experimental features exist in the release to help with broader testing. They should not affect regular operation/policy unless the feature is explicitly enabled.

bin-utils

• aa-status
  • fix filters help message (MR:1151)

Utils

• Adding support for mount rules in aa-genprof/aa-logprof (MR:1153)
• aa-notify
  • new add notification filtering (MR:1154)
  • fix aa-notify last login test (MR:1152,LP:1939022)
• aa-unconfined
  • Fix race when reading proc files (AABUG:355, MR:1157)

Policy

Abstractions

• openssl
  • allow version specific engdef & engines paths (MR:1147,BOO:1219571)

Profiles

• smbd
  • honouring pam restrictions (MR:1159,BOO:1220032)

Unconfined Profiles

• mscode
  • rename from code to mscode
  • allow running from gnome (MR:1156,AABUG:368)
• nautilis (MR:1161,LP:2047256)
• devhelp (MR:1149)
• element-desktop (MR:1150)
• piphany (MR:1149)
• evolution (MR:1149)
• keybase (MR:1145)
• opam (MR:1149)

Infrastructure

• makefiles
  • test for support of flto-partition flag (MR:1155,AABUG:310)

Tests

Regression testing

• handle unprivileged_userns transition in userns tests (MR:1146)
• fix usr-merge failures on exec and regex tests (MR:1146)