980f095fc4
- update to AppArmor 3.0.0
- introduce feature abi declaration in profiles to enable use of
new rule types (for openSUSE: dbus and unix rules)
- support xattr attachment conditionals
- experimental support for kill and unconfined profile modes
- rewritten aa-status (in C), including support for new profile modes
- rewritten aa-notify (in python), finally dropping the perl
requirement at runtime
- new tool aa-features-abi for extracting feature abis from the kernel
- update profiles to have profile names and to use 3.0 feature abi
- introduce @{etc_ro} and @{etc_rw} profile variables
- new profile for php-fpm
- several updates to profiles and abstractions (including boo#1166007)
- fully support 'include if exists' in the aa-* tools
- rewrite handling of alias, include, link and variable rules in
the aa-* tools
- rewrite and simplify log handling in the aa-logprof and aa-genprof
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0
for the detailed upstream changelog
- patches:
- add changes-since-3.0.0.diff with upstream fixes since the 3.0.0
release up to 3e18c0785abc03ee42a022a67a27a085516a7921
- drop upstreamed usr-etc-abstractions-base-nameservice.diff
- drop 2.13-only libapparmor-so-number.diff
- refresh apparmor-enable-profile-cache.diff - partially upstreamed
- update apparmor-samba-include-permissions-for-shares.diff and
apparmor-lessopen-profile.patch - switch to "include if exists"
- apparmor-lessopen-profile.patch: add abi rule to lessopen profile
- refresh apparmor-lessopen-nfs-workaround.diff
- move away very loose apache profile that doesn't even match the
apache2 binary path in openSUSE to avoid confusion (boo#872984)
- move rewritten aa-status from utils to parser subpackage
- add aa-features-abi to parser subpackage
- replace perl and libnotify-tools requires with requiring
python3-notify2 and python3-psutil (needed by the rewritten
aa-notify)
- drop ancient cleanup for /etc/init.d/subdomain from parser %pre
- drop (never enabled) conditionals to build with python2 and to
build the python-apparmor subpackage (upstream dropped python2
support)
- drop setting PYTHON and PYTHON_VERSIONS env variable, no longer needed
- set PYFLAKES path for utils check
- add precompiled_cache build conditional to allow faster local
builds without using kvm
- remove duplicated BuildRequires: swig
libapparmor:
- update to AppArmor 3.0.0
- see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0
for the detailed upstream changelog
- add changes-since-3.0.0.diff with upstream fixes since the 3.0.0
release up to 3e18c0785abc03ee42a022a67a27a085516a7921
- drop 2.13-only patch libapparmor-so-number.diff
OBS-URL: https://build.opensuse.org/request/show/844157
OBS-URL: https://build.opensuse.org/package/show/security:apparmor/apparmor?expand=0&rev=281
36 lines
1001 B
Diff
36 lines
1001 B
Diff
Enable caching of profiles.
|
|
|
|
This speeds up loading the (unchanged) profiles about 20 times.
|
|
|
|
Upstream doesn't enable caching because the cache directory is not
|
|
writeable at the time profiles are loaded in Ubuntu.
|
|
|
|
See also bnc#689458
|
|
|
|
|
|
Also set the cache location to /var/cache/apparmor/ (writeable) and
|
|
/usr/share/apparmor/cache/ (packaged precompiled cache).
|
|
|
|
See boo#1069906 and boo#1074429
|
|
|
|
|
|
Signed-off by: Christian Boltz <apparmor@cboltz.de>
|
|
|
|
Index: parser/parser.conf
|
|
===================================================================
|
|
--- parser/parser.conf_ORIG 2018-04-19 22:47:18.485179998 +0200
|
|
+++ parser/parser.conf 2018-04-19 22:51:12.084588654 +0200
|
|
@@ -31,7 +31,10 @@
|
|
# match-string "pattern=aadfa audit perms=crwxamlk/ user::other"
|
|
|
|
## Turn creating/updating of the cache on by default
|
|
-#write-cache
|
|
+write-cache
|
|
+
|
|
+# cache location (cache writes go to the first directory in the list)
|
|
+cache-loc /var/cache/apparmor,/usr/share/apparmor/cache
|
|
|
|
## Show cache hits
|
|
#show-cache
|
|
|