lp:apparmor

Merge profiles: add asound configs to alsamixer

Author: Ryan Lee
Author Date: 2026年07月09日 18:52:39 UTC

Merge profiles: add asound configs to alsamixer

Fixes: https://bugs.launchpad.net/bugs/2157575
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/2154
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 621184c5fc466aeca9365f23c6cab31420217f2c)

Merge Update postfix and dovecot-dict profiles

Author: John Johansen
Author Date: 2026年07月08日 16:55:28 UTC

Merge Update postfix and dovecot-dict profiles

... with denials noticed on latest openSUSE Tumbleweed

I propose these additions for master, 5.0 and 4.1.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/2158
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

Merge docs: fix typo and increase readability for aa-logprof doc

Author: Christian Boltz
Author Date: 2026年06月17日 11:22:08 UTC

Merge docs: fix typo and increase readability for aa-logprof doc

typo
- `logrof` -> `aa-logprof`

readability
- add squares brackets when specifying logprof.conf section names.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/2148
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>

(cherry picked from commit bdccc1ebd2e1a1b75ceb8f87b23831fe273b9ebb)

bccb1bfd docs: fix typo and increase readability for aa-logprof doc

Co-authored-by: Christian Boltz <apparmor@cboltz.de>

Merge [4.0] Backport CI-related fixes

Author: John Johansen
Author Date: 2026年06月08日 08:47:48 UTC

Merge [4.0] Backport CI-related fixes

* Remove `global` declarations when variables are only read but don't get a new value assigned.

Found by pyflakes 3.3.2 / python 3.13.3

While on it, remove some obsolete, commented out debugging code.
This fixes pyflakes warnings found because of the update CI

(cherry picked from commit 2bfdcb780fc18e0a08aa88f48ba342232a1a764d,
aa.py change adjusted to 4.1 branch)
(cherry picked from commit ef3d48299f4422d79bfb8e85c2bbd07b87c223a0,
aa.py change adjusted to 4.0 branch)

* utils: adjusts aa-notify tests to handle Python 3.13+

Python 3.13 changes the formatting of long-short option pairs that use a
meta-variable. Up until 3.13 the meta-variable was repeated. Since
Python change [1] the meta-var is only printed once.

[1] https://github.com/python/cpython/pull/103372

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 6336465edfc9eac73f8d28f4b84561b10fcb78aa / https://gitlab.com/apparmor/apparmor/-/merge_requests/1495)

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/2139
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

Test suite: increase a couple timeouts to make the tests robust on riscv64

Author: intrigeri
Author Date: 2026年04月21日 08:13:24 UTC

Test suite: increase a couple timeouts to make the tests robust on riscv64

Author: Aurelien Jarno <aurel32@debian.org>

Fixes https://bugs.debian.org/1134203

Revert "Merge unix-chkpwd: add disconnected /run/ paths"

Author: Georgia Garcia
Author Date: 2026年04月20日 18:54:30 UTC

Revert "Merge unix-chkpwd: add disconnected /run/ paths"

This reverts commit ee8642723caa3864a5df9b8dcf9b5a9b0fbf4395

Revert "Merge unix-chkpwd: add disconnected /run/ paths"

Author: Georgia Garcia
Author Date: 2026年04月20日 18:54:08 UTC

Revert "Merge unix-chkpwd: add disconnected /run/ paths"

This reverts commit 6518f006c98602b43001b122832a34dd2213ed52

Merge parser: fix writing dfa flags

Author: John Johansen
Author Date: 2026年04月11日 00:58:27 UTC

Merge parser: fix writing dfa flags

Currently the parser is not correctly setting the dfa flag value
and it hasn't been caught because base policy uses a flag value
of 0.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 6062262ccdf78cecd097303d545e2ee734a93216)
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/2044
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

parser: fix perms_t comparator ordering

Author: Zygmunt Krynicki
Author Date: 2026年03月06日 15:44:49 UTC

parser: fix perms_t comparator ordering

perms_t::operator<() had a duplicated audit comparison and never compared quiet
explicitly. Fix it by comparing quiet as the final field and returning
false when all fields are equal.

The operator is used indirectly via deref_less_than_perms in PermMap, idxmap_t
and in the cache.

I'm not sure if this was sufficient to cause real problems.

Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>

parser: change priority so that it accumulates based on permissions

Author: John Johansen
Author Date: 2024年12月24日 09:27:10 UTC

parser: change priority so that it accumulates based on permissions

The current behavior of priority rules can be non-intuitive with
higher priority rules completely overriding lower priority rules even in
permissions not held in common. This behavior does have use cases but
its can be very confusing, and does not normal policy behavior

Eg.
priority=0 allow r /**,
priority=1 deny w /**,

will result in no allowed permissions even though the deny rule is
only removing the w permission, beause the higher priority rule
completely over ride lower priority permissions sets (including
none shared permissions).

Instead move to tracking the priority at a per permission level. This
allows the w permission to still override at priority 1, while the
read permission is allowed at priority 0.

The final constructed state will still drop priority for the final
permission set on the state.

Note: this patch updates the equality tests for the cases where
the complete override behavior was being tested for.

The complete override behavior will be reintroduced in a future
patch with a keyword extension, enabling that behavior to be used
for ordered blocks etc.

Signed-off-by: John Johansen <john.johansen@canonical.com>

Merge log parsing fixes

Author: Georgia Garcia
Author Date: 2022年12月16日 19:41:41 UTC

Merge log parsing fixes

small fixes on log parsing

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/959
Approved-by: Jon Tourville <jon.tourville@canonical.com>
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit 4f2d2a8cab285a725bf72d0322ddf17df312abe4)
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

Merge [2.11..2.13] Add 'mctp' network domain keyword [only to utils]

Author: John Johansen
Author Date: 2022年08月22日 21:44:14 UTC

Merge [2.11..2.13] Add 'mctp' network domain keyword [only to utils]

Reported as comment on https://build.opensuse.org/request/show/951354
(update to glibc 2.35)

This is a partial backport of
https://gitlab.com/apparmor/apparmor/-/merge_requests/832

I propose this patch for 2.11, 2.12 and 2.13.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/911
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 157c8ee36a09330601ec7667e8ead6d58d2ef4c8)
Signed-off-by: John Johansen <john.johansen@canonical.com>

dirtest.sh: don't rely on apparmor_parser -N's output sort order to be determ...

Author: intrigeri
Author Date: 2022年07月25日 10:04:13 UTC

dirtest.sh: don't rely on apparmor_parser -N's output sort order to be deterministic

I've seen this test fail because "apparmor_parser -N" returned the expected
lines, but in a different order than what's expected (dirtest.out).

To fix this, sort both the expected and actual output.

rc.apparmor.functions: only use systemd-detect-virt if it's present

Author: intrigeri
Author Date: 2022年07月06日 06:41:35 UTC

rc.apparmor.functions: only use systemd-detect-virt if it's present

This is a follow-up on !812, which added a call to systemd-detect-virt.
Everywhere else we don't assume that program is present,
and first check if it's there before we run it.
Let's do the same here.

Merge zgrep: allow executing egrep and fgrep

Author: Christian Boltz
Author Date: 2022年06月29日 13:25:14 UTC

Merge zgrep: allow executing egrep and fgrep

egrep and fgrep also need to execute grep and write to /dev/tty in the
helper child profile.

Fixes: https://progress.opensuse.org/issues/113108

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/892
Approved-by: Jon Tourville <jon.tourville@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>

Merge severity.py: bump test coverage to 100%

Author: John Johansen
Author Date: 2021年04月14日 21:23:35 UTC

Merge severity.py: bump test coverage to 100%

... by adding some new tests, and by marking two lines as "pragma: no branch" because I didn't find a testcase that doesn't let them continue with the next line.

Finally, remove severity.py from the "not 100% covered" list in test/Makefile.

Also run severity tests with the official severity.db instead of the slightly outdated copy in test/.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/737
Acked-by: John Johansen <john.johansen@canonical.com>

Release: Bump revision for 2.10.6 release

Author: John Johansen
Author Date: 2020年12月07日 12:39:38 UTC

Release: Bump revision for 2.10.6 release

Signed-off-by: John Johansen <john.johansen@canonical.com>

Add xdg-open (and friends) abstraction

Author: John Johansen
Author Date: 2020年02月03日 21:32:21 UTC

Add xdg-open (and friends) abstraction

Implement set of abstractions to handle opening uris via xdg-open and similar helpers used on different desktop environments.

Abstractions are intended to be included into child profile, together with bundle abstractions such as ubuntu-browsers, ubuntu-email and others, for fine-grained control on what confined application can actually open via xdg-open and similar helpers.

PR: https://gitlab.com/apparmor/apparmor/-/merge_requests/404
Acked-by: John Johansen <john.johansen@canonical.com>

(cherry picked from commit d257afd3096b25f5d76e2575478c13d4f6930f9a)

622fc44b Add xdg-open (and friends) abstraction
af278ca6 exo-open: Fix denials on OpenSUSE
f07f0771 exo-open: Allow playing alert sounds
80514906 kde-open5: use dbus-network-manager-strict abstraction
ac08dc66 kde-open5: fix denies Ubuntu Eoan
501aada8 gio-open: fix denies Ubuntu Eoan
0a55babe exo-open: do not enable a11y by default
e77abfa5 exo-open: update comment about DBUS denial
d35faafd kde-open5: do not enable a11y by default
8b481d46 kde-open5: do not enable gstreamer support by default
162e5086 xdg-open: update usage example

Merge: abstractions/nameservice: allow accessing /run/systemd/userdb/

Author: John Johansen
Author Date: 2020年03月29日 08:51:55 UTC

Merge: abstractions/nameservice: allow accessing /run/systemd/userdb/

On systems with systemd 245, `nss-systemd` additionally queries NSS records from `systemd-userdbd.service`. See https://systemd.io/USER_GROUP_API/ .

This does not bring full support for `systemd-homed`, but I don't use that service so I can't help with that.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/82
PR: https://gitlab.com/apparmor/apparmor/-/merge_requests/459
Acked-by: John Johansen <john.johansen@canonical.com>

(cherry picked from commit d4296d217c888e08e10bec300fe35351c2ef2f81)

16f9f688 abstractions/nameservice: allow accessing /run/systemd/userdb/

profiles: adjust abstractions/python for python 3.7

Author: Christian Boltz
Author Date: 2018年06月28日 11:34:08 UTC

profiles: adjust abstractions/python for python 3.7

Python 3.7 was released yesterday - and to make the abstraction
future-proof, also cover 3.8 and 3.9 in advance ;-)

(cherry picked from commit 01f41fbff821be7264a4b0aac83ed04747395055)

Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
PR: https://gitlab.com/apparmor/apparmor/merge_requests/139

git conversion: move .bzrignore to .gitignore

Author: Steve Beattie
Author Date: 2017年10月28日 05:46:04 UTC

git conversion: move .bzrignore to .gitignore

Signed-off-by: Steve Beattie <steve.beattie@canonical.com>

Merge from trunk rev 2037:

Author: Kees Cook
Author Date: 2012年04月25日 19:58:58 UTC

Merge from trunk rev 2037:

The m4 shipped to handle Python was incorrectly clearing
$CPPFLAGS. Additionally, do not repeat compiler flags for automake
targets that already include them, and pass more flags to the Perl build.

Signed-off-by: Kees Cook <kees@ubuntu.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>

Merge from trunk revision 1805:

Author: Steve Beattie
Author Date: 2011年08月26日 23:03:03 UTC

Merge from trunk revision 1805:

Attached is a patch to make the initscript not fail if /tmp is full
by converting the comm(1) usage on temporary files to an embedded
awk script. On both Ubuntu and OpenSUSE, a version of awk (mawk in
Ubuntu, gawk in OpenSUSE) is either a direct or indirect dependency
on the minimal or base package set, and the original reporter also
mentioned that an awk-based solution would be palatable in a way
that converting to bash, or using perl or python here would not be.

In the embedded awk script, I've tried to avoid gawk or mawk
specific behaviors or extensions; e.g. this is the reason for the
call to sort on the output of the awk script, rather than using
gawk's asort(). But please let me know if you see anything that
shouldn't be portable across awk implementations.

An additional issue that is fixed in both scripts is handling
child profiles (e.g. hats) during reload. If child profiles are
filtered out (via grep -v '//') of the list to consider, then
on reloading a profile where a child profile has been removed or
renamed, that child profile will continue to stick around. However,
if the profile containing child profiles is removed entirely,
if the initscript attempts to unload the child profiles after the
parent is removed, this will fail because they were unloaded when
the parent was unloaded. Thus I removed any filtering of child
profiles out, but do a post-awk reverse sort which guarantees that
any child profiles will be removed before their parent is. I also
added the LC_COLLATE=C (based on the Ubuntu version) to the sort
call to ensure a consistent sort order.

To restate, the problem with the existing code is that it creates
temporary files in $TMPDIR (by default /tmp) and if that partition
is full, problems with the reload action ensue. Alternate solutions
include switching the initscript to use bash and its <$() extension
or setting TMPDIR to /dev/shm/. The former is unpalatable to some
(particularly for an initscript), and for the latter, /dev/shm is
only guaranteed to exist on GNU libc based systems (glibc apparently
expects /dev/shm to exist for its POSIX shared memory implementation;
see shm_overview(7)). So to me, awk (sans GNU extensions) looks
to be the least bad option here.

Nominated-By: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: John Johansen <john.johansen@canonical.com>

Bug: https://launchpad.net/bugs/775785

Rename tags to conform with git tag requirements

Author: John Johansen
Author Date: 2011年06月06日 17:39:54 UTC

Rename tags to conform with git tag requirements

Rename tags
apparmor_2.5.2~rc1 to apparmor_2.5.2-rc1
apparmor_2.6.0~rc1 to apparmor_2.6.0-rc1

this is necessary for export to the git mirror

Signed-off-by: John Johansen <john.johansen@canonical.com>

remove for-mainline dir from kernel patches

Author: John Johansen
Author Date: 2008年05月27日 12:04:33 UTC

remove for-mainline dir from kernel patches

merge -r 1158 - fix fatal errors so that they have an exit with an exit code

Author: John Johansen
Author Date: 2008年03月28日 07:19:57 UTC

merge -r 1158 - fix fatal errors so that they have an exit with an exit code
of 127