980f095fc4
- update to AppArmor 3.0.0
- introduce feature abi declaration in profiles to enable use of
new rule types (for openSUSE: dbus and unix rules)
- support xattr attachment conditionals
- experimental support for kill and unconfined profile modes
- rewritten aa-status (in C), including support for new profile modes
- rewritten aa-notify (in python), finally dropping the perl
requirement at runtime
- new tool aa-features-abi for extracting feature abis from the kernel
- update profiles to have profile names and to use 3.0 feature abi
- introduce @{etc_ro} and @{etc_rw} profile variables
- new profile for php-fpm
- several updates to profiles and abstractions (including boo#1166007)
- fully support 'include if exists' in the aa-* tools
- rewrite handling of alias, include, link and variable rules in
the aa-* tools
- rewrite and simplify log handling in the aa-logprof and aa-genprof
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0
for the detailed upstream changelog
- patches:
- add changes-since-3.0.0.diff with upstream fixes since the 3.0.0
release up to 3e18c0785abc03ee42a022a67a27a085516a7921
- drop upstreamed usr-etc-abstractions-base-nameservice.diff
- drop 2.13-only libapparmor-so-number.diff
- refresh apparmor-enable-profile-cache.diff - partially upstreamed
- update apparmor-samba-include-permissions-for-shares.diff and
apparmor-lessopen-profile.patch - switch to "include if exists"
- apparmor-lessopen-profile.patch: add abi rule to lessopen profile
- refresh apparmor-lessopen-nfs-workaround.diff
- move away very loose apache profile that doesn't even match the
apache2 binary path in openSUSE to avoid confusion (boo#872984)
- move rewritten aa-status from utils to parser subpackage
- add aa-features-abi to parser subpackage
- replace perl and libnotify-tools requires with requiring
python3-notify2 and python3-psutil (needed by the rewritten
aa-notify)
- drop ancient cleanup for /etc/init.d/subdomain from parser %pre
- drop (never enabled) conditionals to build with python2 and to
build the python-apparmor subpackage (upstream dropped python2
support)
- drop setting PYTHON and PYTHON_VERSIONS env variable, no longer needed
- set PYFLAKES path for utils check
- add precompiled_cache build conditional to allow faster local
builds without using kvm
- remove duplicated BuildRequires: swig
libapparmor:
- update to AppArmor 3.0.0
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0
for the detailed upstream changelog
- add changes-since-3.0.0.diff with upstream fixes since the 3.0.0
release up to 3e18c0785abc03ee42a022a67a27a085516a7921
- drop 2.13-only patch libapparmor-so-number.diff
OBS-URL: https://build.opensuse.org/request/show/844157
OBS-URL: https://build.opensuse.org/package/show/security:apparmor/apparmor?expand=0&rev=281
58 lines
1.4 KiB
Diff
58 lines
1.4 KiB
Diff
Index: profiles/apparmor.d/usr.bin.lessopen.sh
|
|
===================================================================
|
|
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
|
|
+++ profiles/apparmor.d/usr.bin.lessopen.sh 2017-10-28 14:15:12.624358664 +0200
|
|
@@ -0,0 +1,52 @@
|
|
+# vim: ft=apparmor
|
|
+
|
|
+abi <abi/3.0>,
|
|
+
|
|
+#include <tunables/global>
|
|
+
|
|
+/usr/bin/lessopen.sh {
|
|
+ #include <abstractions/base>
|
|
+ #include <abstractions/bash>
|
|
+ #include <abstractions/consoles>
|
|
+ #include <abstractions/perl>
|
|
+
|
|
+ capability dac_override,
|
|
+ capability dac_read_search,
|
|
+
|
|
+ /** rk,
|
|
+ /{usr/,}bin/bash mrix,
|
|
+ /{usr/,}bin/rpm mrix,
|
|
+ /{usr/,}bin/tar mrix,
|
|
+ /tmp/less.* rw,
|
|
+ /usr/bin/bzip2 mrix,
|
|
+ /usr/bin/cabextract mrix,
|
|
+ /usr/bin/cat mrix,
|
|
+ /usr/bin/colordiff mrix,
|
|
+ /usr/bin/dvi2tty mrix,
|
|
+ /usr/bin/eqn mrix,
|
|
+ /usr/bin/file mrix,
|
|
+ /usr/bin/grep mrix,
|
|
+ /usr/bin/groff mrix,
|
|
+ /usr/bin/grotty mrix,
|
|
+ /usr/bin/gzip mrix,
|
|
+ /usr/bin/head mrix,
|
|
+ /usr/bin/lynx mrix,
|
|
+ /usr/bin/mktemp mrix,
|
|
+ /usr/bin/nm mrix,
|
|
+ /usr/bin/pic mrix,
|
|
+ /usr/bin/pdftotext mrix,
|
|
+ /usr/bin/ps2ascii mrix,
|
|
+ /usr/bin/rm mrix,
|
|
+ /usr/bin/seq mrix,
|
|
+ /usr/bin/soelim mrix,
|
|
+ /usr/bin/tar mrix,
|
|
+ /usr/bin/tbl mrix,
|
|
+ /usr/bin/troff mrix,
|
|
+ /usr/bin/unzip mrix,
|
|
+ /usr/bin/unzip-plain mrix,
|
|
+ /usr/bin/w3m mrix,
|
|
+ /usr/bin/which mrix,
|
|
+ /usr/bin/xz mrix,
|
|
+
|
|
+ include if exists <local/usr.bin.lessopen.sh>
|
|
+}
|