Accepting request 953283 from home:cboltz
- update to AppArmor 3.0.4
- various fixes in profiles, abstractions, apparmor_parser and utils
(some of them were already included as patches)
- add support for mctp address family
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4
for the full upstream changelog
- remove upstream(ed) patches:
- aa-notify-more-arch-mr809.diff
- ruby-3.1-build-fix.diff
- add-samba-bgqd.diff
- openssl-engdef-mr818.diff
- profiles-python-3.10-mr783.diff
- update-samba-abstractions-ldb2.diff
- refresh patches:
- apparmor-samba-include-permissions-for-shares.diff
- ruby-2_0-mkmf-destdir.patch
AppArmor 3.0.4 also includes a fix for the issue with 'mctp' found via
https://build.opensuse.org/request/show/951354
so you might want to pick this SR into Staging:O
OBS-URL: https://build.opensuse.org/request/show/953283
OBS-URL: https://build.opensuse.org/package/show/security:apparmor/apparmor?expand=0&rev=316
This commit is contained in:
Git OBS Bridge
parent
a53ba0c4c6
commit
7ae734d682
@ -1,188 +0,0 @@
|
|||||||
This patch contains the code changes from
|
|
||||||
https://gitlab.com/apparmor/apparmor/-/merge_requests/809
|
|
||||||
|
|
||||||
It does NOT include the added unit tests because adding binary test files with a patch is too hard.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
diff --git a/utils/aa-notify b/utils/aa-notify
|
|
||||||
index 91d0f3b9c240e1ff0fec8aa673ef70fa78cf33bc..024044a0c58ed4827502da66786acb4e9b54fc2f 100755
|
|
||||||
--- a/utils/aa-notify
|
|
||||||
+++ b/utils/aa-notify
|
|
||||||
@@ -34,7 +34,6 @@ import os
|
|
||||||
import re
|
|
||||||
import sys
|
|
||||||
import time
|
|
||||||
-import struct
|
|
||||||
import notify2
|
|
||||||
import psutil
|
|
||||||
import pwd
|
|
||||||
@@ -45,6 +44,7 @@ import apparmor.ui as aaui
|
|
||||||
import apparmor.config as aaconfig
|
|
||||||
from apparmor.common import DebugLogger, open_file_read
|
|
||||||
from apparmor.fail import enable_aa_exception_handler
|
|
||||||
+from apparmor.notify import get_last_login_timestamp
|
|
||||||
from apparmor.translations import init_translation
|
|
||||||
|
|
||||||
import LibAppArmor # C-library to parse one log line
|
|
||||||
@@ -61,48 +61,6 @@ def get_user_login():
|
|
||||||
return username
|
|
||||||
|
|
||||||
|
|
||||||
-def get_last_login_timestamp(username):
|
|
||||||
- '''Directly read wtmp and get last login for user as epoch timestamp'''
|
|
||||||
- timestamp = 0
|
|
||||||
- filename = '/var/log/wtmp'
|
|
||||||
- last_login = 0
|
|
||||||
-
|
|
||||||
- debug_logger.debug('Username: {}'.format(username))
|
|
||||||
-
|
|
||||||
- with open(filename, "rb") as wtmp_file:
|
|
||||||
- offset = 0
|
|
||||||
- wtmp_filesize = os.path.getsize(filename)
|
|
||||||
- debug_logger.debug('WTMP filesize: {}'.format(wtmp_filesize))
|
|
||||||
- while offset < wtmp_filesize:
|
|
||||||
- wtmp_file.seek(offset)
|
|
||||||
- offset += 384 # Increment for next entry
|
|
||||||
-
|
|
||||||
- type = struct.unpack("<L", wtmp_file.read(4))[0]
|
|
||||||
- debug_logger.debug('WTMP entry type: {}'.format(type))
|
|
||||||
-
|
|
||||||
- # Only parse USER lines
|
|
||||||
- if type == 7:
|
|
||||||
- # Read each item and move pointer forward
|
|
||||||
- pid = struct.unpack("<L", wtmp_file.read(4))[0]
|
|
||||||
- line = wtmp_file.read(32).decode("utf-8", "replace").split('\0', 1)[0]
|
|
||||||
- id = wtmp_file.read(4).decode("utf-8", "replace").split('\0', 1)[0]
|
|
||||||
- user = wtmp_file.read(32).decode("utf-8", "replace").split('\0', 1)[0]
|
|
||||||
- host = wtmp_file.read(256).decode("utf-8", "replace").split('\0', 1)[0]
|
|
||||||
- term = struct.unpack("<H", wtmp_file.read(2))[0]
|
|
||||||
- exit = struct.unpack("<H", wtmp_file.read(2))[0]
|
|
||||||
- session = struct.unpack("<L", wtmp_file.read(4))[0]
|
|
||||||
- timestamp = struct.unpack("<L", wtmp_file.read(4))[0]
|
|
||||||
- usec = struct.unpack("<L", wtmp_file.read(4))[0]
|
|
||||||
- entry = (pid, line, id, user, host, term, exit, session, timestamp, usec)
|
|
||||||
- debug_logger.debug('WTMP entry: {}'.format(entry))
|
|
||||||
-
|
|
||||||
- # Store login timestamp for requested user
|
|
||||||
- if user == username:
|
|
||||||
- last_login = timestamp
|
|
||||||
-
|
|
||||||
- # When loop is done, last value should be the latest login timestamp
|
|
||||||
- return last_login
|
|
||||||
-
|
|
||||||
|
|
||||||
def format_event(event, logsource):
|
|
||||||
output = []
|
|
||||||
diff --git a/utils/apparmor/notify.py b/utils/apparmor/notify.py
|
|
||||||
new file mode 100644
|
|
||||||
index 0000000000000000000000000000000000000000..1101a29346d79dd873c347fd12dd79cda1e1c786
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/utils/apparmor/notify.py
|
|
||||||
@@ -0,0 +1,105 @@
|
|
||||||
+#! /usr/bin/python3
|
|
||||||
+# ----------------------------------------------------------------------
|
|
||||||
+# Copyright (C) 2018–2019 Otto Kekäläinen <otto@kekalainen.net>
|
|
||||||
+# Copyright (C) 2021 Christian Boltz
|
|
||||||
+#
|
|
||||||
+# This program is free software; you can redistribute it and/or
|
|
||||||
+# modify it under the terms of version 2 of the GNU General Public
|
|
||||||
+# License as published by the Free Software Foundation.
|
|
||||||
+#
|
|
||||||
+# This program is distributed in the hope that it will be useful,
|
|
||||||
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
+# GNU General Public License for more details.
|
|
||||||
+#
|
|
||||||
+# ----------------------------------------------------------------------
|
|
||||||
+
|
|
||||||
+import os
|
|
||||||
+import struct
|
|
||||||
+
|
|
||||||
+from apparmor.common import AppArmorBug, DebugLogger
|
|
||||||
+
|
|
||||||
+debug_logger = DebugLogger('apparmor.notify')
|
|
||||||
+
|
|
||||||
+
|
|
||||||
+def sane_timestamp(timestamp):
|
|
||||||
+ ''' Check if the given timestamp is in a date range that makes sense for a wtmp file '''
|
|
||||||
+
|
|
||||||
+ if timestamp < 946681200: # 2000-01-01
|
|
||||||
+ return False
|
|
||||||
+ elif timestamp > 2524604400: # 2050-01-01
|
|
||||||
+ return False
|
|
||||||
+
|
|
||||||
+ return True
|
|
||||||
+
|
|
||||||
+def get_last_login_timestamp(username, filename='/var/log/wtmp'):
|
|
||||||
+ '''Directly read wtmp and get last login for user as epoch timestamp'''
|
|
||||||
+ timestamp = 0
|
|
||||||
+ last_login = 0
|
|
||||||
+
|
|
||||||
+ debug_logger.debug('Username: {}'.format(username))
|
|
||||||
+
|
|
||||||
+ with open(filename, "rb") as wtmp_file:
|
|
||||||
+ offset = 0
|
|
||||||
+ wtmp_filesize = os.path.getsize(filename)
|
|
||||||
+ debug_logger.debug('WTMP filesize: {}'.format(wtmp_filesize))
|
|
||||||
+
|
|
||||||
+ if wtmp_filesize < 356:
|
|
||||||
+ return 0 # (nearly) empty wtmp file, no entries
|
|
||||||
+
|
|
||||||
+ # detect architecture based on utmp format differences
|
|
||||||
+ wtmp_file.seek(340) # first possible timestamp position
|
|
||||||
+ timestamp_x86_64 = struct.unpack("<L", wtmp_file.read(4))[0]
|
|
||||||
+ timestamp_aarch64 = struct.unpack("<L", wtmp_file.read(4))[0]
|
|
||||||
+ timestamp_s390x = struct.unpack(">L", wtmp_file.read(4))[0]
|
|
||||||
+ debug_logger.debug('WTMP timestamps: x86_64 %s, aarch64 %s, s390x %s' % (timestamp_x86_64, timestamp_aarch64, timestamp_s390x))
|
|
||||||
+
|
|
||||||
+ if sane_timestamp(timestamp_x86_64):
|
|
||||||
+ endianness = '<' # little endian
|
|
||||||
+ extra_offset_before = 0
|
|
||||||
+ extra_offset_after = 0
|
|
||||||
+ elif sane_timestamp(timestamp_aarch64):
|
|
||||||
+ endianness = '<' # little endian
|
|
||||||
+ extra_offset_before = 4
|
|
||||||
+ extra_offset_after = 12
|
|
||||||
+ elif sane_timestamp(timestamp_s390x):
|
|
||||||
+ endianness = '>' # big endian
|
|
||||||
+ extra_offset_before = 8
|
|
||||||
+ extra_offset_after = 8
|
|
||||||
+ else:
|
|
||||||
+ raise AppArmorBug('Your /var/log/wtmp is broken or has an unknown format. Please open a bugreport with /var/log/wtmp and the output of "last" attached!')
|
|
||||||
+
|
|
||||||
+ while offset < wtmp_filesize:
|
|
||||||
+ wtmp_file.seek(offset)
|
|
||||||
+ offset += 384 + extra_offset_before + extra_offset_after # Increment for next entry
|
|
||||||
+
|
|
||||||
+ type = struct.unpack('%sH' % endianness, wtmp_file.read(2))[0]
|
|
||||||
+ debug_logger.debug('WTMP entry type: {}'.format(type))
|
|
||||||
+ wtmp_file.read(2) # skip padding
|
|
||||||
+
|
|
||||||
+ # Only parse USER lines
|
|
||||||
+ if type == 7:
|
|
||||||
+ # Read each item and move pointer forward
|
|
||||||
+ pid = struct.unpack("<L", wtmp_file.read(4))[0]
|
|
||||||
+ line = wtmp_file.read(32).decode("utf-8", "replace").split('\0', 1)[0]
|
|
||||||
+ id = wtmp_file.read(4).decode("utf-8", "replace").split('\0', 1)[0]
|
|
||||||
+ user = wtmp_file.read(32).decode("utf-8", "replace").split('\0', 1)[0]
|
|
||||||
+ host = wtmp_file.read(256).decode("utf-8", "replace").split('\0', 1)[0]
|
|
||||||
+ term = struct.unpack("<H", wtmp_file.read(2))[0]
|
|
||||||
+ exit = struct.unpack("<H", wtmp_file.read(2))[0]
|
|
||||||
+ session = struct.unpack("<L", wtmp_file.read(4))[0]
|
|
||||||
+ if extra_offset_before:
|
|
||||||
+ wtmp_file.read(extra_offset_before)
|
|
||||||
+ timestamp = struct.unpack('%sL' % endianness, wtmp_file.read(4))[0]
|
|
||||||
+ if extra_offset_after:
|
|
||||||
+ wtmp_file.read(extra_offset_after)
|
|
||||||
+ usec = struct.unpack("<L", wtmp_file.read(4))[0]
|
|
||||||
+ entry = (pid, line, id, user, host, term, exit, session, timestamp, usec)
|
|
||||||
+ debug_logger.debug('WTMP entry: {}'.format(entry))
|
|
||||||
+
|
|
||||||
+ # Store login timestamp for requested user
|
|
||||||
+ if user == username:
|
|
||||||
+ last_login = timestamp
|
|
||||||
+
|
|
||||||
+ # When loop is done, last value should be the latest login timestamp
|
|
||||||
+ return last_login
|
|
||||||
@ -1,62 +0,0 @@
|
|||||||
commit 85e53a5d040cdf3f7705da9e625b85041694aa4c
|
|
||||||
Author: Christian Boltz <apparmor@cboltz.de>
|
|
||||||
Date: Fri Oct 15 22:02:36 2021 +0200
|
|
||||||
|
|
||||||
Add profile for samba-bgqd
|
|
||||||
|
|
||||||
... and some rules in the smbd profile to execute it and send it a term
|
|
||||||
signal.
|
|
||||||
|
|
||||||
samba-bgqd is (quoting its manpage) "an internal helper program
|
|
||||||
performing asynchronous printing-related jobs."
|
|
||||||
|
|
||||||
samba-bgqd was added in Samba 4.15.
|
|
||||||
|
|
||||||
Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1191532
|
|
||||||
|
|
||||||
Index: apparmor-3.0.3/profiles/apparmor.d/samba-bgqd
|
|
||||||
===================================================================
|
|
||||||
--- /dev/null
|
|
||||||
+++ apparmor-3.0.3/profiles/apparmor.d/samba-bgqd
|
|
||||||
@@ -0,0 +1,20 @@
|
|
||||||
+abi <abi/3.0>,
|
|
||||||
+
|
|
||||||
+include <tunables/global>
|
|
||||||
+
|
|
||||||
+profile samba-bgqd /usr/lib*/samba/samba-bgqd {
|
|
||||||
+ include <abstractions/base>
|
|
||||||
+ include <abstractions/cups-client>
|
|
||||||
+ include <abstractions/nameservice>
|
|
||||||
+ include <abstractions/samba>
|
|
||||||
+
|
|
||||||
+ signal receive set=term peer=smbd,
|
|
||||||
+
|
|
||||||
+ @{PROC}/sys/kernel/core_pattern r,
|
|
||||||
+ @{run}/samba/samba-bgqd.pid wk,
|
|
||||||
+
|
|
||||||
+ /usr/lib*/samba/samba-bgqd m,
|
|
||||||
+
|
|
||||||
+ # Site-specific additions and overrides. See local/README for details.
|
|
||||||
+ include if exists <local/samba-bgqd>
|
|
||||||
+}
|
|
||||||
Index: apparmor-3.0.3/profiles/apparmor.d/usr.sbin.smbd
|
|
||||||
===================================================================
|
|
||||||
--- apparmor-3.0.3.orig/profiles/apparmor.d/usr.sbin.smbd
|
|
||||||
+++ apparmor-3.0.3/profiles/apparmor.d/usr.sbin.smbd
|
|
||||||
@@ -24,6 +24,8 @@ profile smbd /usr/{bin,sbin}/smbd {
|
|
||||||
capability sys_resource,
|
|
||||||
capability sys_tty_config,
|
|
||||||
|
|
||||||
+ signal send set=term peer=samba-bgqd,
|
|
||||||
+
|
|
||||||
/etc/mtab r,
|
|
||||||
/etc/netgroup r,
|
|
||||||
/etc/printcap r,
|
|
||||||
@@ -35,6 +37,7 @@ profile smbd /usr/{bin,sbin}/smbd {
|
|
||||||
/usr/lib*/samba/charset/*.so mr,
|
|
||||||
/usr/lib*/samba/gensec/*.so mr,
|
|
||||||
/usr/lib*/samba/pdb/*.so mr,
|
|
||||||
+ /usr/lib*/samba/samba-bgqd Px -> samba-bgqd,
|
|
||||||
/usr/lib*/samba/{lowcase,upcase,valid}.dat r,
|
|
||||||
/usr/lib/@{multiarch}/samba/*.so{,.[0-9]*} mr,
|
|
||||||
/usr/lib/@{multiarch}/samba/**/ r,
|
|
||||||
@ -1,3 +0,0 @@
|
|||||||
version https://git-lfs.github.com/spec/v1
|
|
||||||
oid sha256:153db05d8f491e0596022663c19fb1166806cb473b3c6f0a7279feda2ec25a59
|
|
||||||
size 7790012
|
|
||||||
@ -1,17 +0,0 @@
|
|||||||
-----BEGIN PGP SIGNATURE-----
|
|
||||||
|
|
||||||
iQJOBAABCgA4FiEEPs3Lpfs00lSWHMU/ZonmTj02ZLsFAmEOR6AaHGFwcGFybW9y
|
|
||||||
QGxpc3RzLnVidW50dS5jb20ACgkQZonmTj02ZLsckQ//V7k3Kao73EXlJKtTjMnt
|
|
||||||
AVc1qUqht/bxfT014BYZs0eT8HYRyBq0BhbDBfjPJA05kyXO0eHDOip5QmltXHR6
|
|
||||||
qeRD974rgv4jmIHInHiY2QlFuAtxhO+CPsSw2WZtdQMb1zFYg9BMh+lSz2aNECrc
|
|
||||||
GRYi4UflsNFxnUGnKCIt3FKvaGX9S9dA3vEgQrXMcIEFvHzrcRPYtUGiutFe66xF
|
|
||||||
S6Z2PoymQAK5fW4D1lkBZXAx1jqzNzVzaaA6D0H8GcFb7zL2c2q/0L4+EfFabxXv
|
|
||||||
uP4Vtw6ZS6upLr7AsbE55t8QlJ0IwiA7EJhn7cFfvJNkGWsJh9dr0LGtIf+B+zTd
|
|
||||||
1dVtwuNtWotz202WeyYuokddX/zCSldb6/Sc2BhyFhqmUWjeQdDqjfLyTVsmBpc9
|
|
||||||
0+NwY53/Em1qoFvMAtiqGWG3JjTF3ZVEdQEzRQyG9zMBDm2Vm3+uplL70MjgdSm0
|
|
||||||
Cb1wpSsef5/Q28qY7+1/WV3/OGdq/9kqWS0n3+i2JtuxAaiHK6FRhSZi+0QGU0QH
|
|
||||||
igJ+TKYmtyDGiqYrCasmED9sBkGNKvSDRmc+0hfCEzk5sj3tYR65OBmO0JBMKVR4
|
|
||||||
9Lyt2hXScP7avuMdTPU0kj/2i7o5N6OfDdCV9LQinN8rzMmwGIYinmTxcVoRN9i/
|
|
||||||
wYTg3RfP5TxHfmrOnuzWCCM=
|
|
||||||
=2ySc
|
|
||||||
-----END PGP SIGNATURE-----
|
|
||||||
3
apparmor-3.0.4.tar.gz
Normal file
3
apparmor-3.0.4.tar.gz
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
version https://git-lfs.github.com/spec/v1
|
||||||
|
oid sha256:09bf48d7a171f9790c39a1404bad105a788934cfe77b7490c7f5c63c2576b725
|
||||||
|
size 7796852
|
||||||
17
apparmor-3.0.4.tar.gz.asc
Normal file
17
apparmor-3.0.4.tar.gz.asc
Normal file
@ -0,0 +1,17 @@
|
|||||||
|
-----BEGIN PGP SIGNATURE-----
|
||||||
|
|
||||||
|
iQJOBAABCgA4FiEEPs3Lpfs00lSWHMU/ZonmTj02ZLsFAmIEYPoaHGFwcGFybW9y
|
||||||
|
QGxpc3RzLnVidW50dS5jb20ACgkQZonmTj02ZLsuXRAAwUfR2mTa8T1f9JKDV9oI
|
||||||
|
VyHMNPx4UQ8UGHPjdggPZpgU8tdLgIeTzrVB9IFmUNxREmeQURyr12lWJiL7rUjp
|
||||||
|
uICigANNZPtfYDB8PNF6OPbwZ61A44RZ26SZJauKQg/iP1c/m3NH24TReUqB2UgC
|
||||||
|
Zrjx4KBH30m0+wc2Ca5f017CRDRL6oPjbUnCdY6S8XdVzbbd4x/4K0yoaS8mNLde
|
||||||
|
GUbs4cMJnuMndVPhNVIiKvRt/qmYl2nB3HBzU9VXmq/GBR9wDpb1G6N3IuB7Oaak
|
||||||
|
WrB32ymgllwi5av3L1vXQhisZ1LAaH7GNElCX5c4rJa/6Bsfru5kTecEXSIJXf2H
|
||||||
|
P8XmwUkdrl7idfAbSg/jW1h02uD99WTymii2SCwYWhNX9s0BRuSMPASA9TgrYOZN
|
||||||
|
oTshsA8lYaAafdAU6OboaeS91WL65hTr3GUcGgYl+qYcYTdyU6IG4MooCwATM2st
|
||||||
|
SHt7HPOJLNntMt8CGcPx1Q9UA8ta3kNlcf6YSycWCqWvPEvCkpex23gVUVIXzVKr
|
||||||
|
bs2tvJO59BsCxiL6umsksv5otIXDrm4yay1QaYl+KUEOvU051SUyXey7pQ/qO0LY
|
||||||
|
leifVmldlLfPosAKiJqiQ3RAKp7Zr/YrvKLLxeLj5MrKUmSR2UQ5xC8aXfYYhDqh
|
||||||
|
+PPpcMO9Io9UyHHofXB7dlA=
|
||||||
|
=rXSS
|
||||||
|
-----END PGP SIGNATURE-----
|
||||||
@ -20,7 +20,7 @@ Signed-off-by: Christian Boltz <apparmor@cboltz.de>
|
|||||||
=== modified file 'profiles/apparmor.d/usr.sbin.smbd'
|
=== modified file 'profiles/apparmor.d/usr.sbin.smbd'
|
||||||
--- profiles/apparmor.d/usr.sbin.smbd 2011-08-27 18:50:42 +0000
|
--- profiles/apparmor.d/usr.sbin.smbd 2011-08-27 18:50:42 +0000
|
||||||
+++ profiles/apparmor.d/usr.sbin.smbd 2011-10-19 09:37:04 +0000
|
+++ profiles/apparmor.d/usr.sbin.smbd 2011-10-19 09:37:04 +0000
|
||||||
@@ -56,6 +56,10 @@
|
@@ -59,6 +59,10 @@
|
||||||
@{HOMEDIRS}/** lrwk,
|
@{HOMEDIRS}/** lrwk,
|
||||||
/var/lib/samba/usershares/{,**} lrwk,
|
/var/lib/samba/usershares/{,**} lrwk,
|
||||||
|
|
||||||
|
|||||||
@ -1,3 +1,23 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu Feb 10 16:55:38 UTC 2022 - Christian Boltz <suse-beta@cboltz.de>
|
||||||
|
|
||||||
|
- update to AppArmor 3.0.4
|
||||||
|
- various fixes in profiles, abstractions, apparmor_parser and utils
|
||||||
|
(some of them were already included as patches)
|
||||||
|
- add support for mctp address family
|
||||||
|
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4
|
||||||
|
for the full upstream changelog
|
||||||
|
- remove upstream(ed) patches:
|
||||||
|
- aa-notify-more-arch-mr809.diff
|
||||||
|
- ruby-3.1-build-fix.diff
|
||||||
|
- add-samba-bgqd.diff
|
||||||
|
- openssl-engdef-mr818.diff
|
||||||
|
- profiles-python-3.10-mr783.diff
|
||||||
|
- update-samba-abstractions-ldb2.diff
|
||||||
|
- refresh patches:
|
||||||
|
- apparmor-samba-include-permissions-for-shares.diff
|
||||||
|
- ruby-2_0-mkmf-destdir.patch
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Wed Jan 26 17:14:58 UTC 2022 - Christian Boltz <suse-beta@cboltz.de>
|
Wed Jan 26 17:14:58 UTC 2022 - Christian Boltz <suse-beta@cboltz.de>
|
||||||
|
|
||||||
|
|||||||
@ -45,7 +45,7 @@
|
|||||||
%define JAR_FILE changeHatValve.jar
|
%define JAR_FILE changeHatValve.jar
|
||||||
|
|
||||||
Name: apparmor
|
Name: apparmor
|
||||||
Version: 3.0.3
|
Version: 3.0.4
|
||||||
Release: 0
|
Release: 0
|
||||||
Summary: AppArmor userlevel parser utility
|
Summary: AppArmor userlevel parser utility
|
||||||
License: GPL-2.0-or-later
|
License: GPL-2.0-or-later
|
||||||
@ -78,26 +78,6 @@ Patch5: apparmor-lessopen-nfs-workaround.diff
|
|||||||
# make <apache2.d> include in apache extra profile optional to make openQA happy (boo#1178527)
|
# make <apache2.d> include in apache extra profile optional to make openQA happy (boo#1178527)
|
||||||
Patch6: apache-extra-profile-include-if-exists.diff
|
Patch6: apache-extra-profile-include-if-exists.diff
|
||||||
|
|
||||||
# update abstractions/python and profiles for python 3.10 (submitted upstream 2021-08-11 https://gitlab.com/apparmor/apparmor/-/merge_requests/783)
|
|
||||||
Patch7: profiles-python-3.10-mr783.diff
|
|
||||||
|
|
||||||
# add samba-bgqd profile (accepted upstream 2021-10-15 https://gitlab.com/apparmor/apparmor/-/merge_requests/807)
|
|
||||||
# updated for boo#1192336 (merged upstream 2021-12-20 https://gitlab.com/apparmor/apparmor/-/merge_requests/819 in 3.0 and master)
|
|
||||||
Patch8: add-samba-bgqd.diff
|
|
||||||
|
|
||||||
# aa-notify: Add support for reading s390x and aarch64 wtmp file (boo#1181155) (merged upstream 2021-11-08 in master and 3.0 branch - https://gitlab.com/apparmor/apparmor/-/merge_requests/809)
|
|
||||||
Patch9: aa-notify-more-arch-mr809.diff
|
|
||||||
|
|
||||||
# allow reading /etc/ssl/engdef.d/ and /etc/ssl/engines.d/ in abstractions/openssl (submitted upstream 2021-12-19 - https://gitlab.com/apparmor/apparmor/-/merge_requests/818)
|
|
||||||
Patch10: openssl-engdef-mr818.diff
|
|
||||||
|
|
||||||
# add update-samba-abstractions-ldb2.diff to cater for changes to ldb
|
|
||||||
# packaging to allow parallel installation with libldb bsc#1192684 (submitted upstream 2022-01-17 - https://gitlab.com/apparmor/apparmor/-/merge_requests/821)
|
|
||||||
Patch11: update-samba-abstractions-ldb2.diff
|
|
||||||
|
|
||||||
# fix build with ruby 3.1 (boo#1194221, from upstream https://gitlab.com/apparmor/apparmor/-/merge_requests/827)
|
|
||||||
Patch12: ruby-3.1-build-fix.diff
|
|
||||||
|
|
||||||
PreReq: sed
|
PreReq: sed
|
||||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||||
%define apparmor_bin_prefix %{?usrmerged:/usr}/lib/apparmor
|
%define apparmor_bin_prefix %{?usrmerged:/usr}/lib/apparmor
|
||||||
@ -360,12 +340,6 @@ mv -v profiles/apparmor.d/usr.lib.apache2.mpm-prefork.apache2 profiles/apparmor/
|
|||||||
%patch3 -p1
|
%patch3 -p1
|
||||||
%patch4
|
%patch4
|
||||||
%patch5
|
%patch5
|
||||||
%patch7 -p1
|
|
||||||
%patch8 -p1
|
|
||||||
%patch9 -p1
|
|
||||||
%patch10 -p1
|
|
||||||
%patch11 -p1
|
|
||||||
%patch12 -p1
|
|
||||||
|
|
||||||
%build
|
%build
|
||||||
%define _lto_cflags %{nil}
|
%define _lto_cflags %{nil}
|
||||||
|
|||||||
@ -18,7 +18,7 @@
|
|||||||
|
|
||||||
|
|
||||||
Name: libapparmor
|
Name: libapparmor
|
||||||
Version: 3.0.3
|
Version: 3.0.4
|
||||||
Release: 0
|
Release: 0
|
||||||
Summary: Utility library for AppArmor
|
Summary: Utility library for AppArmor
|
||||||
License: LGPL-2.1-or-later
|
License: LGPL-2.1-or-later
|
||||||
|
|||||||
@ -1,26 +0,0 @@
|
|||||||
(context lines adjusted to match 3.0 branch)
|
|
||||||
|
|
||||||
From e58dd798f09c1df6f8de42f64d07221d34adfc87 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Christian Boltz <apparmor@cboltz.de>
|
|
||||||
Date: Sun, 19 Dec 2021 22:36:05 +0100
|
|
||||||
Subject: [PATCH] abstractions/openssl: allow /etc/ssl/{engdef,engines}.d/
|
|
||||||
|
|
||||||
These directories were introduced in openssl in
|
|
||||||
https://patchwork.ozlabs.org/project/openwrt/patch/20210429153530.10020-2-cotequeiroz@gmail.com/
|
|
||||||
---
|
|
||||||
profiles/apparmor.d/abstractions/openssl | 2 ++
|
|
||||||
1 file changed, 2 insertions(+)
|
|
||||||
|
|
||||||
Index: profiles/apparmor.d/abstractions/openssl
|
|
||||||
===================================================================
|
|
||||||
--- a/profiles/apparmor.d/abstractions/openssl.orig 2021-12-19 22:51:13.837139097 +0100
|
|
||||||
+++ b/profiles/apparmor.d/abstractions/openssl 2021-12-19 22:52:05.845049787 +0100
|
|
||||||
@@ -12,6 +12,8 @@
|
|
||||||
|
|
||||||
/etc/ssl/openssl.cnf r,
|
|
||||||
/usr/share/ssl/openssl.cnf r,
|
|
||||||
+ /etc/ssl/{engdef,engines}.d/ r,
|
|
||||||
+ /etc/ssl/{engdef,engines}.d/*.cnf r,
|
|
||||||
@{PROC}/sys/crypto/fips_enabled r,
|
|
||||||
|
|
||||||
|
|
||||||
@ -1,86 +0,0 @@
|
|||||||
https://gitlab.com/apparmor/apparmor/-/merge_requests/783
|
|
||||||
|
|
||||||
From ea7b201ba48b87469297d58751c57b03ceb82320 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Christian Boltz <apparmor@cboltz.de>
|
|
||||||
Date: Wed, 11 Aug 2021 21:37:40 +0200
|
|
||||||
Subject: [PATCH] Update abstractions/python and profiles for python 3.10
|
|
||||||
|
|
||||||
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/187
|
|
||||||
---
|
|
||||||
profiles/apparmor.d/abstractions/python | 18 +++++++++---------
|
|
||||||
profiles/apparmor.d/lsb_release | 2 +-
|
|
||||||
.../profiles/extras/usr.bin.chromium-browser | 4 ++--
|
|
||||||
3 files changed, 12 insertions(+), 12 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/profiles/apparmor.d/abstractions/python b/profiles/apparmor.d/abstractions/python
|
|
||||||
index 1b5cc9d0d..727030bdf 100644
|
|
||||||
--- a/profiles/apparmor.d/abstractions/python
|
|
||||||
+++ b/profiles/apparmor.d/abstractions/python
|
|
||||||
@@ -12,18 +12,18 @@
|
|
||||||
|
|
||||||
abi <abi/3.0>,
|
|
||||||
|
|
||||||
- /usr/lib{,32,64}/python{2.[4-7],3.[0-9]}/**.{pyc,so} mr,
|
|
||||||
- /usr/lib{,32,64}/python{2.[4-7],3.[0-9]}/**.{egg,py,pth} r,
|
|
||||||
- /usr/lib{,32,64}/python{2.[4-7],3.[0-9]}/{site,dist}-packages/ r,
|
|
||||||
+ /usr/lib{,32,64}/python{2.[4-7],3.[0-9],3.1[0-9]}/**.{pyc,so} mr,
|
|
||||||
+ /usr/lib{,32,64}/python{2.[4-7],3.[0-9],3.1[0-9]}/**.{egg,py,pth} r,
|
|
||||||
+ /usr/lib{,32,64}/python{2.[4-7],3.[0-9],3.1[0-9]}/{site,dist}-packages/ r,
|
|
||||||
/usr/lib{,32,64}/python3.[0-9]/lib-dynload/*.so mr,
|
|
||||||
|
|
||||||
- /usr/local/lib{,32,64}/python{2.[4-7],3,3.[0-9]}/**.{pyc,so} mr,
|
|
||||||
- /usr/local/lib{,32,64}/python{2.[4-7],3,3.[0-9]}/**.{egg,py,pth} r,
|
|
||||||
- /usr/local/lib{,32,64}/python{2.[4-7],3,3.[0-9]}/{site,dist}-packages/ r,
|
|
||||||
- /usr/local/lib{,32,64}/python3.[0-9]/lib-dynload/*.so mr,
|
|
||||||
+ /usr/local/lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{pyc,so} mr,
|
|
||||||
+ /usr/local/lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/**.{egg,py,pth} r,
|
|
||||||
+ /usr/local/lib{,32,64}/python{2.[4-7],3,3.[0-9],3.1[0-9]}/{site,dist}-packages/ r,
|
|
||||||
+ /usr/local/lib{,32,64}/python3.{1,}[0-9]/lib-dynload/*.so mr,
|
|
||||||
|
|
||||||
# Site-wide configuration
|
|
||||||
- /etc/python{2.[4-7],3.[0-9]}/** r,
|
|
||||||
+ /etc/python{2.[4-7],3.[0-9],3.1[0-9]}/** r,
|
|
||||||
|
|
||||||
# shared python paths
|
|
||||||
/usr/share/{pyshared,pycentral,python-support}/** r,
|
|
||||||
@@ -36,7 +36,7 @@
|
|
||||||
/usr/lib/wx/python/*.pth r,
|
|
||||||
|
|
||||||
# python build configuration and headers
|
|
||||||
- /usr/include/python{2.[4-7],3.[0-9]}*/pyconfig.h r,
|
|
||||||
+ /usr/include/python{2.[4-7],3.[0-9],3.1[0-9]}*/pyconfig.h r,
|
|
||||||
|
|
||||||
# Include additions to the abstraction
|
|
||||||
include if exists <abstractions/python.d>
|
|
||||||
diff --git a/profiles/apparmor.d/lsb_release b/profiles/apparmor.d/lsb_release
|
|
||||||
index 33a1c71db..ad8b998fc 100644
|
|
||||||
--- a/profiles/apparmor.d/lsb_release
|
|
||||||
+++ b/profiles/apparmor.d/lsb_release
|
|
||||||
@@ -18,7 +18,7 @@ profile lsb_release {
|
|
||||||
/dev/tty rw,
|
|
||||||
|
|
||||||
/usr/bin/lsb_release r,
|
|
||||||
- /usr/bin/python3.[0-9] mr,
|
|
||||||
+ /usr/bin/python3.{1,}[0-9] mr,
|
|
||||||
|
|
||||||
/etc/debian_version r,
|
|
||||||
/etc/default/apport r,
|
|
||||||
diff --git a/profiles/apparmor/profiles/extras/usr.bin.chromium-browser b/profiles/apparmor/profiles/extras/usr.bin.chromium-browser
|
|
||||||
index 2df5338db..b47b6f721 100644
|
|
||||||
--- a/profiles/apparmor/profiles/extras/usr.bin.chromium-browser
|
|
||||||
+++ b/profiles/apparmor/profiles/extras/usr.bin.chromium-browser
|
|
||||||
@@ -267,9 +267,9 @@ profile chromium_browser /usr/lib/@{chromium}/@{chromium} flags=(attach_disconne
|
|
||||||
/usr/share/distro-info/** r,
|
|
||||||
/var/lib/dpkg/** r,
|
|
||||||
|
|
||||||
- /usr/local/lib/python3.[0-9]/dist-packages/ r,
|
|
||||||
+ /usr/local/lib/python3.{1,}[0-9]/dist-packages/ r,
|
|
||||||
/usr/bin/ r,
|
|
||||||
- /usr/bin/python3.[0-9] mr,
|
|
||||||
+ /usr/bin/python3.{1,}[0-9] mr,
|
|
||||||
}
|
|
||||||
|
|
||||||
profile sandbox {
|
|
||||||
--
|
|
||||||
GitLab
|
|
||||||
|
|
||||||
@ -1,10 +1,11 @@
|
|||||||
diff -wruN -x '*~' -x '*.o' -x '*.a' -x '*.so' -x '*.so.[0-9]' -x autom4te.cache -x .deps -x .libs -x Makefile -x Makefile ../orig-apparmor-2.8.1/libraries/libapparmor/swig/ruby/extconf.rb ./libraries/libapparmor/swig/ruby/extconf.rb
|
Index: libraries/libapparmor/swig/ruby/extconf.rb
|
||||||
--- ../orig-apparmor-2.8.1/libraries/libapparmor/swig/ruby/extconf.rb 2009-05-12 23:56:56.000000000 +0200
|
===================================================================
|
||||||
+++ ./libraries/libapparmor/swig/ruby/extconf.rb 2013-06-04 14:52:01.677579537 +0200
|
--- a/libraries/libapparmor/swig/ruby/extconf.rb.orig 2022-02-10 17:54:05.008544807 +0100
|
||||||
@@ -28,7 +28,14 @@
|
+++ b/libraries/libapparmor/swig/ruby/extconf.rb 2022-02-10 17:54:21.792506325 +0100
|
||||||
|
@@ -20,7 +20,14 @@ if find_library('apparmor', 'parse_recor
|
||||||
# hack 2: strip all rpath references
|
# hack 2: strip all rpath references
|
||||||
open('Makefile.ruby', 'w') do |out|
|
open('Makefile.ruby', 'w') do |out|
|
||||||
IO.foreach('Makefile.new') do |line|
|
IO.foreach('Makefile') do |line|
|
||||||
- out.puts line.gsub(/-Wl,-R'[^']*'/, '')
|
- out.puts line.gsub(/-Wl,-R'[^']*'/, '')
|
||||||
+ l = line.gsub(/-Wl,-R'[^']*'/, '')
|
+ l = line.gsub(/-Wl,-R'[^']*'/, '')
|
||||||
+ # oldincludedir = $(DESTDIR)/usr/include
|
+ # oldincludedir = $(DESTDIR)/usr/include
|
||||||
|
|||||||
@ -1,110 +0,0 @@
|
|||||||
https://gitlab.com/apparmor/apparmor/-/merge_requests/827
|
|
||||||
|
|
||||||
From fde8acf86ddb82f1c10332478daebd3fad1bee45 Mon Sep 17 00:00:00 2001
|
|
||||||
From: John Johansen <john.johansen@canonical.com>
|
|
||||||
Date: Wed, 26 Jan 2022 08:04:04 -0800
|
|
||||||
Subject: [PATCH] libapparmor: Fix ruby 3.1 build for libapparmor
|
|
||||||
|
|
||||||
The Hack used to build the libapparmor swig interface for ruby fails
|
|
||||||
with ruby 3.1. Instead of trying to do black magic in ruby to rename
|
|
||||||
the generated Makefile to Makefile.new, just save off the Makefile
|
|
||||||
and restore after ruby's setup has been called.
|
|
||||||
|
|
||||||
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/206
|
|
||||||
Signed-off-by: John Johansen <john.johansen@canonical.com>
|
|
||||||
---
|
|
||||||
.gitignore | 2 +-
|
|
||||||
libraries/libapparmor/swig/ruby/Makefile.am | 4 +++-
|
|
||||||
libraries/libapparmor/swig/ruby/extconf.rb | 14 +++-----------
|
|
||||||
3 files changed, 7 insertions(+), 13 deletions(-)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Additionally patch libraries/libapparmor/swig/ruby/Makefile.in which is shipped
|
|
||||||
in the tarball and based on Makefile.am.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
diff --git a/.gitignore b/.gitignore
|
|
||||||
index 4782a351a..bac706f2b 100644
|
|
||||||
--- a/.gitignore
|
|
||||||
+++ b/.gitignore
|
|
||||||
@@ -177,7 +177,7 @@ libraries/libapparmor/swig/ruby/LibAppArmor_wrap.c
|
|
||||||
libraries/libapparmor/swig/ruby/LibAppArmor_wrap.o
|
|
||||||
libraries/libapparmor/swig/ruby/Makefile
|
|
||||||
libraries/libapparmor/swig/ruby/Makefile.in
|
|
||||||
-libraries/libapparmor/swig/ruby/Makefile.new
|
|
||||||
+libraries/libapparmor/swig/ruby/Makefile.bak
|
|
||||||
libraries/libapparmor/swig/ruby/Makefile.ruby
|
|
||||||
libraries/libapparmor/swig/ruby/mkmf.log
|
|
||||||
libraries/libapparmor/testsuite/.deps
|
|
||||||
diff --git a/libraries/libapparmor/swig/ruby/Makefile.am b/libraries/libapparmor/swig/ruby/Makefile.am
|
|
||||||
index 03ef02fd6..3f4572816 100644
|
|
||||||
--- a/libraries/libapparmor/swig/ruby/Makefile.am
|
|
||||||
+++ b/libraries/libapparmor/swig/ruby/Makefile.am
|
|
||||||
@@ -9,7 +9,9 @@ LibAppArmor_wrap.c : $(srcdir)/../SWIG/libapparmor.i
|
|
||||||
MOSTLYCLEANFILES=LibAppArmor_wrap.c
|
|
||||||
|
|
||||||
Makefile.ruby: extconf.rb
|
|
||||||
+ mv Makefile Makefile.bak
|
|
||||||
PREFIX=$(prefix) $(RUBY) $< --with-LibAppArmor-include=$(top_srcdir)/include
|
|
||||||
+ mv Makefile.bak Makefile
|
|
||||||
|
|
||||||
LibAppArmor.so: LibAppArmor_wrap.c Makefile.ruby
|
|
||||||
$(MAKE) -fMakefile.ruby
|
|
||||||
@@ -22,7 +24,7 @@ install-exec-local: Makefile.ruby
|
|
||||||
|
|
||||||
clean-local:
|
|
||||||
if test -f Makefile.ruby; then $(MAKE) -fMakefile.ruby clean; fi
|
|
||||||
- rm -f Makefile.ruby Makefile.new
|
|
||||||
+ rm -f Makefile.ruby Makefile.new Makefile.bak
|
|
||||||
rm -f *.o *.so *.log
|
|
||||||
|
|
||||||
endif
|
|
||||||
diff --git a/libraries/libapparmor/swig/ruby/extconf.rb b/libraries/libapparmor/swig/ruby/extconf.rb
|
|
||||||
index 647d2d831..6a2ef7457 100644
|
|
||||||
--- a/libraries/libapparmor/swig/ruby/extconf.rb
|
|
||||||
+++ b/libraries/libapparmor/swig/ruby/extconf.rb
|
|
||||||
@@ -2,16 +2,8 @@
|
|
||||||
|
|
||||||
require 'mkmf'
|
|
||||||
|
|
||||||
-# hack 1: ruby black magic to write a Makefile.new instead of a Makefile
|
|
||||||
-alias open_orig open
|
|
||||||
-def open(path, mode=nil, perm=nil)
|
|
||||||
- path = 'Makefile.new' if path == 'Makefile'
|
|
||||||
- if block_given?
|
|
||||||
- open_orig(path, mode, perm) { |io| yield(io) }
|
|
||||||
- else
|
|
||||||
- open_orig(path, mode, perm)
|
|
||||||
- end
|
|
||||||
-end
|
|
||||||
+# hack 1: Before extconf.rb gets called, Makefile gets backed up, and
|
|
||||||
+# restored afterwards (see Makefile.am)
|
|
||||||
|
|
||||||
if ENV['PREFIX']
|
|
||||||
prefix = CONFIG['prefix']
|
|
||||||
@@ -27,7 +19,7 @@ if find_library('apparmor', 'parse_record', '../../src/.libs') and
|
|
||||||
|
|
||||||
# hack 2: strip all rpath references
|
|
||||||
open('Makefile.ruby', 'w') do |out|
|
|
||||||
- IO.foreach('Makefile.new') do |line|
|
|
||||||
+ IO.foreach('Makefile') do |line|
|
|
||||||
l = line.gsub(/-Wl,-R'[^']*'/, '')
|
|
||||||
# oldincludedir = $(DESTDIR)/usr/include
|
|
||||||
# -> oldincludedir = /usr/include
|
|
||||||
Index: apparmor-3.0.3/libraries/libapparmor/swig/ruby/Makefile.in
|
|
||||||
===================================================================
|
|
||||||
--- apparmor-3.0.3.orig/libraries/libapparmor/swig/ruby/Makefile.in 2022-01-26 13:13:38.958238926 +0100
|
|
||||||
+++ apparmor-3.0.3/libraries/libapparmor/swig/ruby/Makefile.in 2022-01-26 13:15:08.206094528 +0100
|
|
||||||
@@ -469,7 +469,9 @@ uninstall-am:
|
|
||||||
@HAVE_RUBY_TRUE@ $(SWIG) -ruby -module LibAppArmor -I$(top_srcdir)/include -o $@ $(srcdir)/../SWIG/libapparmor.i
|
|
||||||
|
|
||||||
@HAVE_RUBY_TRUE@Makefile.ruby: extconf.rb
|
|
||||||
+@HAVE_RUBY_TRUE@ mv Makefile Makefile.bak
|
|
||||||
@HAVE_RUBY_TRUE@ PREFIX=$(prefix) $(RUBY) $< --with-LibAppArmor-include=$(top_srcdir)/include
|
|
||||||
+@HAVE_RUBY_TRUE@ mv Makefile.bak Makefile
|
|
||||||
|
|
||||||
@HAVE_RUBY_TRUE@LibAppArmor.so: LibAppArmor_wrap.c Makefile.ruby
|
|
||||||
@HAVE_RUBY_TRUE@ $(MAKE) -fMakefile.ruby
|
|
||||||
@ -1,12 +0,0 @@
|
|||||||
diff -ruNp apparmor-3.0.3.orig/profiles/apparmor.d/abstractions/samba apparmor-3.0.3/profiles/apparmor.d/abstractions/samba
|
|
||||||
--- apparmor-3.0.3.orig/profiles/apparmor.d/abstractions/samba 2021-08-07 10:40:00.000000000 +0200
|
|
||||||
+++ apparmor-3.0.3/profiles/apparmor.d/abstractions/samba 2022-01-17 16:25:37.552673486 +0100
|
|
||||||
@@ -13,6 +13,8 @@
|
|
||||||
|
|
||||||
/etc/samba/* r,
|
|
||||||
/usr/lib*/ldb/*.so mr,
|
|
||||||
+ /usr/lib*/ldb2/*.so mr,
|
|
||||||
+ /usr/lib*/ldb2/modules/ldb/*.so mr,
|
|
||||||
/usr/lib*/samba/ldb/*.so mr,
|
|
||||||
/usr/share/samba/*.dat r,
|
|
||||||
/usr/share/samba/codepages/{lowcase,upcase,valid}.dat r,
|
|
||||||
Loading…
x
Reference in New Issue
Block a user