Accepting request 1068311 from home:cboltz
- update to AppArmor 3.1.3 - add support for more audit.log formats in libapparmor - add abstractions/groff (boo#1065388) - various additions in abstractions and profiles - several bug fixes in parser and utils - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.1.3 for the detailed upstream changelog - drop upstreamed patches: - abstractions-openssl-1_1.diff - dnsmasq-cpu-possible.diff - nscd-systemd-userdb.diff OBS-URL: https://build.opensuse.org/request/show/1068311 OBS-URL: https://build.opensuse.org/package/show/security:apparmor/apparmor?expand=0&rev=364
This commit is contained in:
Christian Boltz
Git OBS Bridge
parent
01b087876d
commit
2d719d1da8
@ -1,12 +0,0 @@
|
|||||||
diff --git a/profiles/apparmor.d/abstractions/openssl b/profiles/apparmor.d/abstractions/openssl
|
|
||||||
index c0c09fb45..65939ae44 100644
|
|
||||||
--- a/profiles/apparmor.d/abstractions/openssl
|
|
||||||
+++ b/profiles/apparmor.d/abstractions/openssl
|
|
||||||
@@ -11,6 +11,7 @@
|
|
||||||
abi <abi/3.0>,
|
|
||||||
|
|
||||||
/etc/ssl/openssl.cnf r,
|
|
||||||
+ /etc/ssl/openssl-*.cnf r,
|
|
||||||
/etc/ssl/{engdef,engines}.d/ r,
|
|
||||||
/etc/ssl/{engdef,engines}.d/*.cnf r,
|
|
||||||
/usr/share/ssl/openssl.cnf r,
|
|
||||||
@ -1,3 +0,0 @@
|
|||||||
version https://git-lfs.github.com/spec/v1
|
|
||||||
oid sha256:7cbd0b2f6393abf57acaf25dc2b32b2ae197c0b5b0d661e14be46127df93a5eb
|
|
||||||
size 7955759
|
|
||||||
@ -1,17 +0,0 @@
|
|||||||
-----BEGIN PGP SIGNATURE-----
|
|
||||||
|
|
||||||
iQJOBAABCgA4FiEEPs3Lpfs00lSWHMU/ZonmTj02ZLsFAmNpUt4aHGFwcGFybW9y
|
|
||||||
QGxpc3RzLnVidW50dS5jb20ACgkQZonmTj02ZLv3KBAAtyXSGLM6vX2MflFtYbxd
|
|
||||||
0WrdhjKPvMer165f9RaUCzO5zdqKaAFm9vDkwQl/S3uWr0lmN8AWGhkcqNZq2BXQ
|
|
||||||
68Oyd74P2pT8Rt3bJwwqJnubh4GK3YohpXaoo7TEO/rLgB0Di9dZFOmF539TWIOg
|
|
||||||
kHj71kbxtsVCoX+TptzjJGaR+xeLebV9UaHRZpMt8j8f6M7bUUQELW2lRhDfqJL5
|
|
||||||
1wTp3mnSfNQlZvKDlMu+Tv0tH3k4tD6+w1mvACUS5mHJ7N3W9NS5/EahbY1rmRNp
|
|
||||||
4VPO5zKyD0781NFDwkX/zN9kEHIKjtTr/gEm7ZBoHMR6okeMCwv/GEzUBsTKYPJE
|
|
||||||
wegqVOUV+jGpW8O6Md425JjlWU2QXKN8O5vYFTZ5zkPx7G9j54UbvUYOqUz3jNKi
|
|
||||||
28WCOkJXoOdO8tUuxJu+haavikX2j//J44KqieB5kmVMkMt8CC2Rha+oARJGUdVY
|
|
||||||
FTjrcvd3MJGfW7WnUriHnhvv0X/MoGN3LTPBYFnRTWGB5B/ziwFqUrZZ4VKF7hv/
|
|
||||||
vTbDtv761JS6eT8KfUsllSnsbRvw5GBs9p6n21i9DyyD3c/Pcdl8RyZ3iTasE/yM
|
|
||||||
m17h9OwaW2rbr7E92EniQ+XXpuxiSE9UkM5+4y7cfJO9KkTv5JfJgqYXBhg0Dsfd
|
|
||||||
DboJouLwNvPXPH/Pk/by4Fk=
|
|
||||||
=qSnn
|
|
||||||
-----END PGP SIGNATURE-----
|
|
||||||
3
apparmor-3.1.3.tar.gz
Normal file
3
apparmor-3.1.3.tar.gz
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
version https://git-lfs.github.com/spec/v1
|
||||||
|
oid sha256:b8ffac45d0b283afe574ddd5542142ba1a62c354df110cff862b99201f29c843
|
||||||
|
size 7959220
|
||||||
17
apparmor-3.1.3.tar.gz.asc
Normal file
17
apparmor-3.1.3.tar.gz.asc
Normal file
@ -0,0 +1,17 @@
|
|||||||
|
-----BEGIN PGP SIGNATURE-----
|
||||||
|
|
||||||
|
iQJOBAABCgA4FiEEPs3Lpfs00lSWHMU/ZonmTj02ZLsFAmP9apoaHGFwcGFybW9y
|
||||||
|
QGxpc3RzLnVidW50dS5jb20ACgkQZonmTj02ZLuN5Q/+Pb6CY8pkSe2/WfDwALRE
|
||||||
|
Rg+U+Swe1ulSsUfT4mahMmFtycJgcNNMdsfQ0t6Sm1liXHQ+nvOSeAiEapQs8FD1
|
||||||
|
J/vfnJ6drFoLRoBgjFjZ8Ezn5JByZGblZrbwME8AN8j7KZbZpAlCDdn4X69TprtS
|
||||||
|
tdDcSqBlGwKjTKHXhwWn9z7V1fjbNHlSlr/2oaP4o9YflhxmjYRbmzBZNhbF4oBP
|
||||||
|
W/1h7XZog7BATcbwvWKfxujw4UOlLMq/jmUVa3RAkbOlpCh1gb0N1ezcwEX1Skcw
|
||||||
|
lWsDn4p0jCFvKTEYFojQf1Ta0Dk8+YtfBPYRY2jfPMe0ateNPZzOO2CiaCwsUWBC
|
||||||
|
fyASdhESG5NgNUYeXu/QLciKaEpVuFEaNKBj1P1U7MJRXriw+8Kopf94+v4XJlwF
|
||||||
|
l8RmUMI5UoLpBMCe3tMH2Pmw1h6/3xEm8C6pFjBS0RVsaoCbNfSCsgK+SzF4wC/9
|
||||||
|
lTA1Hym2bQGq+zDiiitavugwcbWvVpcOxafApHeVkgCFkcATNYpLbqeuWLarBdIh
|
||||||
|
NH7j2MsojE/yBN7D09s3hYVxVzB5vHgYUiXEsjOENfMSzUyf/sZQBlb1wq/Bc/5s
|
||||||
|
N08yWBHYxF9oXNIpg7o2U2ZZNHXUzlpFbW6COrvoRXLvqY5iLgOo0rwxZc1+j5hg
|
||||||
|
U+HJGZ1PP/S5Jsrm4MS1BsY=
|
||||||
|
=/kHo
|
||||||
|
-----END PGP SIGNATURE-----
|
||||||
@ -1,3 +1,18 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Tue Feb 28 19:35:17 UTC 2023 - Christian Boltz <suse-beta@cboltz.de>
|
||||||
|
|
||||||
|
- update to AppArmor 3.1.3
|
||||||
|
- add support for more audit.log formats in libapparmor
|
||||||
|
- add abstractions/groff (boo#1065388)
|
||||||
|
- various additions in abstractions and profiles
|
||||||
|
- several bug fixes in parser and utils
|
||||||
|
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.1.3
|
||||||
|
for the detailed upstream changelog
|
||||||
|
- drop upstreamed patches:
|
||||||
|
- abstractions-openssl-1_1.diff
|
||||||
|
- dnsmasq-cpu-possible.diff
|
||||||
|
- nscd-systemd-userdb.diff
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Mon Feb 6 19:27:40 UTC 2023 - Christian Boltz <suse-beta@cboltz.de>
|
Mon Feb 6 19:27:40 UTC 2023 - Christian Boltz <suse-beta@cboltz.de>
|
||||||
|
|
||||||
|
|||||||
@ -54,7 +54,7 @@
|
|||||||
%define JAR_FILE changeHatValve.jar
|
%define JAR_FILE changeHatValve.jar
|
||||||
|
|
||||||
Name: apparmor
|
Name: apparmor
|
||||||
Version: 3.1.2
|
Version: 3.1.3
|
||||||
Release: 0
|
Release: 0
|
||||||
Summary: AppArmor userlevel parser utility
|
Summary: AppArmor userlevel parser utility
|
||||||
License: GPL-2.0-or-later
|
License: GPL-2.0-or-later
|
||||||
@ -88,15 +88,6 @@ Patch5: apparmor-lessopen-nfs-workaround.diff
|
|||||||
# make <apache2.d> include in apache extra profile optional to make openQA happy (boo#1178527)
|
# make <apache2.d> include in apache extra profile optional to make openQA happy (boo#1178527)
|
||||||
Patch6: apache-extra-profile-include-if-exists.diff
|
Patch6: apache-extra-profile-include-if-exists.diff
|
||||||
|
|
||||||
# allow reading /sys/devices/system/cpu/possible in dnsmasc//libvirt-leaseshelper (boo#1202849, submitted upstream 2022-08-28 https://gitlab.com/apparmor/apparmor/-/merge_requests/917)
|
|
||||||
Patch12: dnsmasq-cpu-possible.diff
|
|
||||||
|
|
||||||
# allow nscd to read systemd userdb (boo#1207698, submitted upstream 2023-01-30 https://gitlab.com/apparmor/apparmor/-/merge_requests/977)
|
|
||||||
Patch13: nscd-systemd-userdb.diff
|
|
||||||
|
|
||||||
# abstractions/openssl: allow to read /etc/ssl/openssl-1_1.cnf (boo#1207911, upstreaming TODO)
|
|
||||||
Patch14: abstractions-openssl-1_1.diff
|
|
||||||
|
|
||||||
PreReq: sed
|
PreReq: sed
|
||||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||||
BuildRequires: bison
|
BuildRequires: bison
|
||||||
@ -361,9 +352,6 @@ mv -v profiles/apparmor.d/usr.lib.apache2.mpm-prefork.apache2 profiles/apparmor/
|
|||||||
%patch4
|
%patch4
|
||||||
%patch5
|
%patch5
|
||||||
%patch6
|
%patch6
|
||||||
%patch12 -p1
|
|
||||||
%patch13 -p1
|
|
||||||
%patch14 -p1
|
|
||||||
|
|
||||||
%build
|
%build
|
||||||
export SUSE_ASNEEDED=0
|
export SUSE_ASNEEDED=0
|
||||||
|
|||||||
@ -1,22 +0,0 @@
|
|||||||
commit ace8e04477662aff656b341ca173d1205e02b46e
|
|
||||||
Author: Christian Boltz <apparmor@cboltz.de>
|
|
||||||
Date: Sun Aug 28 12:32:17 2022 +0200
|
|
||||||
|
|
||||||
Allow reading /sys/devices/system/cpu/possible
|
|
||||||
|
|
||||||
... in the dnsmasq//libvirt_leaseshelper profile
|
|
||||||
|
|
||||||
Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1202849
|
|
||||||
|
|
||||||
diff --git a/profiles/apparmor.d/usr.sbin.dnsmasq b/profiles/apparmor.d/usr.sbin.dnsmasq
|
|
||||||
index 379d72fb0..9a5ca0b78 100644
|
|
||||||
--- a/profiles/apparmor.d/usr.sbin.dnsmasq
|
|
||||||
+++ b/profiles/apparmor.d/usr.sbin.dnsmasq
|
|
||||||
@@ -127,6 +127,7 @@ profile dnsmasq /usr/{bin,sbin}/dnsmasq flags=(attach_disconnected) {
|
|
||||||
owner @{PROC}/@{pid}/status r,
|
|
||||||
|
|
||||||
@{sys}/devices/system/cpu/ r,
|
|
||||||
+ @{sys}/devices/system/cpu/possible r,
|
|
||||||
@{sys}/devices/system/node/ r,
|
|
||||||
@{sys}/devices/system/node/*/meminfo r,
|
|
||||||
|
|
||||||
@ -18,7 +18,7 @@
|
|||||||
|
|
||||||
|
|
||||||
Name: libapparmor
|
Name: libapparmor
|
||||||
Version: 3.1.2
|
Version: 3.1.3
|
||||||
Release: 0
|
Release: 0
|
||||||
Summary: Utility library for AppArmor
|
Summary: Utility library for AppArmor
|
||||||
License: LGPL-2.1-or-later
|
License: LGPL-2.1-or-later
|
||||||
|
|||||||
@ -1,36 +0,0 @@
|
|||||||
From https://gitlab.com/apparmor/apparmor/-/merge_requests/977
|
|
||||||
|
|
||||||
From cb83ab51636e93371225c21906e01821b5b4261a Mon Sep 17 00:00:00 2001
|
|
||||||
From: Christian Boltz <apparmor@cboltz.de>
|
|
||||||
Date: Mon, 30 Jan 2023 12:26:31 +0100
|
|
||||||
Subject: [PATCH] nscd: allow using systemd-userdb
|
|
||||||
|
|
||||||
If systemd-userdb is used to configure some users, nscd needs to read
|
|
||||||
the userdb files.
|
|
||||||
|
|
||||||
See also https://www.freedesktop.org/software/systemd/man/nss-systemd.html
|
|
||||||
for the list of possible filenames (and symlinks).
|
|
||||||
|
|
||||||
Fixes: http://bugzilla.opensuse.org/show_bug.cgi?id=1207698
|
|
||||||
---
|
|
||||||
profiles/apparmor.d/usr.sbin.nscd | 4 ++++
|
|
||||||
1 file changed, 4 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/profiles/apparmor.d/usr.sbin.nscd b/profiles/apparmor.d/usr.sbin.nscd
|
|
||||||
index 80f970988..baa858ea6 100644
|
|
||||||
--- a/profiles/apparmor.d/usr.sbin.nscd
|
|
||||||
+++ b/profiles/apparmor.d/usr.sbin.nscd
|
|
||||||
@@ -41,6 +41,10 @@ profile nscd /usr/{bin,sbin}/nscd {
|
|
||||||
@{PROC}/@{pid}/fd/* r,
|
|
||||||
@{PROC}/@{pid}/mounts r,
|
|
||||||
|
|
||||||
+ # systemd-userdb
|
|
||||||
+ /{etc,run,run/host,/usr/lib}/userdb/ r,
|
|
||||||
+ /{etc,run,run/host,/usr/lib}/userdb/*.{user,user-privileged,group,group-privileged} r,
|
|
||||||
+
|
|
||||||
# Site-specific additions and overrides. See local/README for details.
|
|
||||||
include if exists <local/usr.sbin.nscd>
|
|
||||||
}
|
|
||||||
--
|
|
||||||
GitLab
|
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user