Accepting request 1177352 from security:apparmor
- exclude runc profile until updated runc packages (including updated profile with "signal peer=runc") have arrived - add aa-remove-unknown-fix-unconfined.diff to fix aa-remove-unknown for 'unconfined' profiles (boo#1225457) - set permissions for %ghost files (boo#1223578) (forwarded request 1177351 from cboltz) OBS-URL: https://build.opensuse.org/request/show/1177352 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apparmor?expand=0&rev=207
This commit is contained in:
commit
a92857537c
26
aa-remove-unknown-fix-unconfined.diff
Normal file
26
aa-remove-unknown-fix-unconfined.diff
Normal file
@ -0,0 +1,26 @@
|
||||
commit cabd88a94055d2a7b876758d36fe559a6b728f45
|
||||
Author: Christian Boltz <apparmor@cboltz.de>
|
||||
Date: Sat May 25 13:12:49 2024 +0200
|
||||
|
||||
Fix aa-remove-unknown for 'unconfined' profiles
|
||||
|
||||
Without this patch, aa-remove-unknown uses 'profile_name (unconfined)'
|
||||
when trying to unload unconfined profiles, which fails for obvious
|
||||
reasons with (picking a random example)
|
||||
|
||||
Removing 'busybox (unconfined)'
|
||||
/sbin/aa-remove-unknown: line 112: echo: write error: No such file or directory
|
||||
|
||||
diff --git a/utils/aa-remove-unknown b/utils/aa-remove-unknown
|
||||
index 0e00d6a03..983d23727 100755
|
||||
--- a/utils/aa-remove-unknown
|
||||
+++ b/utils/aa-remove-unknown
|
||||
@@ -89,7 +89,7 @@ LOADED_PROFILES=$("$PARSER" -N $PROFILE_DIRS) || {
|
||||
echo "$LOADED_PROFILES" | awk '
|
||||
BEGIN {
|
||||
while (getline < "'${PROFILES}'" ) {
|
||||
- str = sub(/ \((enforce|complain)\)$/, "", $0);
|
||||
+ str = sub(/ \((enforce|complain|unconfined)\)$/, "", $0);
|
||||
if (match($0, /^libvirt-[0-9a-f\-]+$/) == 0)
|
||||
arr[$str] = $str
|
||||
}
|
@ -1,3 +1,16 @@
|
||||
-------------------------------------------------------------------
|
||||
Tue May 28 12:20:59 UTC 2024 - Christian Boltz <suse-beta@cboltz.de>
|
||||
|
||||
- exclude runc profile until updated runc packages (including
|
||||
updated profile with "signal peer=runc") have arrived
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Sat May 25 11:31:05 UTC 2024 - Christian Boltz <suse-beta@cboltz.de>
|
||||
|
||||
- add aa-remove-unknown-fix-unconfined.diff to fix
|
||||
aa-remove-unknown for 'unconfined' profiles (boo#1225457)
|
||||
- set permissions for %ghost files (boo#1223578)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri May 24 12:21:18 UTC 2024 - Christian Boltz <suse-beta@cboltz.de>
|
||||
|
||||
|
@ -88,6 +88,9 @@ Patch10: tools-fix-redefinition.diff
|
||||
# make test-aa-notify a bit more relaxed to allow different argparse wording on Leap 15.5 (merged upstream 2024-05-06 (4.0 and master) https://gitlab.com/apparmor/apparmor/-/merge_requests/1226)
|
||||
Patch11: test-aa-notify.diff
|
||||
|
||||
# Fix aa-remove-unknown for 'unconfined' profiles (submitted upstream 2024-05-25 https://gitlab.com/apparmor/apparmor/-/merge_requests/1240)
|
||||
Patch12: aa-remove-unknown-fix-unconfined.diff
|
||||
|
||||
PreReq: sed
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||
BuildRequires: autoconf
|
||||
@ -357,6 +360,7 @@ mv -v profiles/apparmor.d/usr.lib.apache2.mpm-prefork.apache2 profiles/apparmor/
|
||||
%endif
|
||||
%patch -P 10 -p1
|
||||
%patch -P 11 -p1
|
||||
%patch -P 12 -p1
|
||||
|
||||
%build
|
||||
export SUSE_ASNEEDED=0
|
||||
@ -426,7 +430,7 @@ for oldlocal in \
|
||||
usr.sbin.identd usr.sbin.mdnsd usr.sbin.nmbd usr.sbin.nscd usr.sbin.ntpd usr.sbin.smbd usr.sbin.smbd-shares usr.sbin.smbldap-useradd usr.sbin.traceroute \
|
||||
usr.sbin.winbindd zgrep
|
||||
do
|
||||
echo "%ghost /etc/apparmor.d/local/$oldlocal"
|
||||
echo "%ghost %config %attr(0644,root,root) /etc/apparmor.d/local/$oldlocal"
|
||||
done > oldlocal.files
|
||||
|
||||
%check
|
||||
@ -660,7 +664,9 @@ rm -fv %{buildroot}%{_libdir}/libapparmor.la
|
||||
%config(noreplace) %{_sysconfdir}/apparmor.d/rootlesskit
|
||||
%config(noreplace) %{_sysconfdir}/apparmor.d/rpm
|
||||
%config(noreplace) %{_sysconfdir}/apparmor.d/rssguard
|
||||
%config(noreplace) %{_sysconfdir}/apparmor.d/runc
|
||||
# exclude runc profile until the updated runc (including updated profile with "signal peer=runc") has arrived
|
||||
#config(noreplace) %{_sysconfdir}/apparmor.d/runc
|
||||
%exclude %{_sysconfdir}/apparmor.d/runc
|
||||
%config(noreplace) %{_sysconfdir}/apparmor.d/samba-bgqd
|
||||
%config(noreplace) %{_sysconfdir}/apparmor.d/samba-dcerpcd
|
||||
%config(noreplace) %{_sysconfdir}/apparmor.d/samba-rpcd
|
||||
|
Loading…
Reference in New Issue
Block a user