1 Release_Notes_5.0

John Johansen edited this page 2024-03-27 23:59:27 +00:00

Table of Contents

• WARNING WIP - NOT released targeted to fall 2023
• TODO IMPORTANT !!!!!
• Introduction
• Highlighted new features
• Important Notes
• Obtaining the Release
• gitlab release
• Launchpad Tarball
• Changes in this Release
• General improvments
• Build Infrastructure
• Policy Compiler (a.k.a apparmor_parser)
• Init
• aa-teardown
• Library
• Utils
• aa-exec
• aa-decode
• aa-notify
• Policy
• abstractions
• profiles
• Documentation
• Translations
• Tests
• Note

WARNING WIP - NOT released targeted to fall 2023

This release has not happened and these notes will be revised

AppArmor 3.0 was released 2020-10-01.

TODO IMPORTANT !!!!!

remove parser.conf pin before release

Introduction

AppArmor 4.0 is a major new release of the AppArmor user space that makes several important change to policy development and support. Its focus is transitioning policy to the new policy features.

Apprmor 4.0 is a bridge release between older AppArmor 3.x policy and the newer AppArmor 4 style policy which introduces several new features that are not backwards compatible. As such AppArmor 4.0 will be a short lived release, and will not receive long term support. The following AppArmor 4.1 feature release is planned to be a regular release, please take this into account when including AppArmor 4.0 into a distro release.

This version of the userspace should work with all kernel versions from 2.6.15 and later (some earlier version of the kernel if they have the apparmor patches applied). And supports features released in the 4.20 kernel.

Note: that while older kernels are supported, not all features available in AppArmor 4.0 policy can be enforced on older kernels.

The kernel portion of the project is maintained and pushed separately.

Highlighted new features

• profile flags

  • prompt
  • audit.XXX
  • attach_disconnected.path

• prefix

  • access, kill, prompt, complain

• block prefxes

• audit ctl

  • quiet

• conditionals

  • owner applies to more rules
  • user

• profile attachments

  • user
  • deny

• boolean policy operations

• policy overlays

• fine grained mediation

  • ipv4
  • ipv6
  • af_unix revisions
  • mqueue

• exec dominance

• rule priority

• capability improvements

• rlimit improvements

• change_profile changes

• policy restrictions

  • link
  • mount
  • move/rename
    • subtree
    • overlap attachment???

• conditionals

  • compare funs
  • used in preamble

• labels with rules

  • use label directive

• abi changes

  • rules not in policy abi can be used - warns

• raw text policy

• aa_load

Important Notes

• gitlab release tarballs: Differ from the launchpad release tarballs. The launchpad release tarball has a couple processing steps already performed:

  • libapparmor autogen.sh is already done, meaning distros only need to use ./configure in their build setup
  • the docs for everything but libapparmor have already been built

• Potentially breaking changes:

• ????

• ????

Obtaining the Release

There are two ways to obtain this release either through gitlab or a tarball in launchpad. Important note: the gitlab release tarballs: Differ from the launchpad release tarballs. The launchpad release tarball has a couple processing steps already performed:

• libapparmor autogen.sh is already done, meaning distros only need to use ./configure in their build setup
• the docs for everything but libapparmor have already been built

gitlab release

• https://gitlab.com/apparmor/apparmor/-/releases/v4.0.0

Launchpad Tarball

• https://launchpad.net/apparmor/4.0/4.0/+download/apparmor-4.0.0.tar.gz
• sha256sum: XXX
• signature: https://launchpad.net/apparmor/4.0/4.0/+download/apparmor-4.0.0.tar.gz.asc

Changes in this Release

These release notes cover all changes between 3.1 (XXX) and 4.0 (XXXX) apparmor-4.0 branch.

Includes all the bug fixes and improvements in

• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4

And the following improvements

General improvments

Build Infrastructure

Policy Compiler (a.k.a apparmor_parser)

Init

• XXX

• aa-teardown

Library

• XXXX

Utils

• aa-enabled
  • XXXX
• aa-status
  • filters XXX

• aa-exec

• aa-decode

• aa-notify

• genprof, logprof and aa python library,

Policy

• XXXX

abstractions

• General changes
  • XXXX
• apache2-common
  • XXXX
• base
  • XXXX

profiles

• General changes
  • XXX
• chromium profile
  • XXXX

Documentation

• XXXX
• apparmor.d
  • XXX
• apparmor_parser
  • XXX
• apparmor
  • XXX
• aa-status
  • document filters
• libapparmor
  • XXX

Translations

• sync translation from launchpad

Tests

• regression tests

Note