3 Release_Notes_4.1 beta5

John Johansen edited this page 2025-02-19 03:05:46 +00:00

Table of Contents

• WARNING this is a beta - NOT a final release
• Introduction
• Notes
• Known issues
• Obtaining the Release
• gitlab
• Changes in this Release
• Build & Infrastructure
• Utils
• Policy
• abstractions
• profiles
• Tests
• Documentation

WARNING this is a beta - NOT a final release

AppArmor 4.1~beta4 was released on 2025-02-11.

Introduction

AppArmor 4.1 is a major new release of the AppArmor that is in development.

Apprmor 4.1 is a long term stable (5 years of support) release for the AppArmor 4.x policy which introduces several new features that are not backwards compatible.

These release notes cover changes between AppArmor-4.1~beta1 and AppArmor-4.1~beta4 (Note: includes notes for Beta2 and Beta3 which was dropped due to technical issues).

Notes

• This Release contains bug fixes to AppArmor 4.1 beta4
• This release includes new CI E2E testing via the spread frame work. A big thanks to Zygmunt Krynicki for all his work on improving the testing.

Known issues

• profile: unshare has a known issue around profile transitions
• utils do not handle priorities in rules
• utils do not handle leading permissions
• utils crash if they can't parse all files in the profile directory
• mount rules
  • control of disconnect mounts is missing
  • handling of conflicting mount options is not backwards compatible

Obtaining the Release

This beta release is only available through gitlab

Important note: the gitlab release tarballs differ from the launchpad release tarballs. The launchpad release tarball has a couple processing steps already performed:

• libapparmor autogen.sh is already done, meaning distros only need to use ./configure in their build setup
• the docs for everything but libapparmor have already been built

gitlab

• https://gitlab.com/apparmor/apparmor/-/releases/4.1.0-beta5

Changes in this Release

Build & Infrastructure

• utils
  • allow install locations to be overridden in Makefile (MR:1542)
  • aa-notify
    • fix package build install of polkit files (MR:1540, AABUG:486)
• libapparmor
  • build fixes for 32-bit systems and older systems (MR:1536)

Utils

• aa-genprof
  • fix failure on lxd with OSError: Read-only file system (MR:1539)
• aa-notify
  • rename polkit files and template info from com.ubuntu (MR:1540, MR:1541, AABUG:486)
  • aa-notify: make ttkthemes conditional - extracted and backported from MR:

Policy

abstractions

• tunables
  • add letter, alphanumeric character, int, hex and words variables (MR:1546, MR:1544)
• new devices-usb & devices-usb-read (MR:1545)

profiles

• unshare
  • fix non-user-namespace-related sandbox bypass in unshare profile (MR:1533)

Tests

• CI/CD spread tests
  • provide better output on failures (MR:1548)
  • mark fixed regression tests (MR:1547)

Documentation

• apparmor.d: document how variable expansion and path sanitization works (MR:1532)