AppArmor 2.13.5 was released 2020-10-15.
Introduction
AppArmor 2.13.5 is a maintenance release of the user space components of the AppArmor security project. The kernel portion of the project is maintained and pushed separately.
This version of the userspace should work with all kernel versions from 2.6.15 and later (some earlier version of the kernel if they have the apparmor patches applied). And supports features released in the 4.18 kernel and ubuntu 18.04 kernel with the apparmor 3 development patches.
Important Note
- gitlab release tarballs: Differ from the launchpad release tarballs. The both start from the same commit (tagged v2.13.5) however the launchpad release tarball has a couple processing steps already performed:
- libapparmor
autogen.sh
is already done, meaning distros only need to use ./configure in their build setup - the docs for everything but libapparmor have already been built
- libapparmor
Obtaining the Release
There are two ways to obtain this release either through gitlab or a tarball in launchpad. Important note: the gitlab release tarballs: Differ from the launchpad release tarballs. The launchpad release tarball has a couple processing steps already performed:
- libapparmor
autogen.sh
is already done, meaning distros only need to use ./configure in their build setup - the docs for everything but libapparmor have already been built
gitlab release
Launchpad Tarball
- https://launchpad.net/apparmor/2.13/2.13.5/+download/apparmor-2.13.5.tar.gz
- sha256sum: 637e2a14d844e53e0f0b31dc8fe8821f7bb36908c709ccc23e29033053caa717
- signature: https://launchpad.net/apparmor/2.13/2.13.5/+download/apparmor-2.13.5.tar.gz.asc
Changes in this Release
These release notes cover all changes between 2.13.4 df0ac742f7a1146181d8734d03334494f2015134 and 2.13.5 ab0f4ab2ed7e734827b143cd32dace4444875e9b on the apparmor-2.13 branch.
Build Infrastructure
-
Fix build when using Make 4.3 (MR:465,BOO:1167953,AABUG:74)
-
Fix build for cross compiles (MR:485)
-
profiles
-
apparmor.vim
Init
- Fix profile load when using busybox (AABUG:80)
Libapparmor
- Fix potential build failure when dynamically linking the apparmor_parser by add _aa_asprintf to private symbols (MR:643)
- Fix build failure on musl libc (MR:642)
Policy Compiler (a.k.a apparmor_parser)
- improve error handling in the lexer (MR:572)
- fix parsing around Whitespace and newline for some rules (MR:572)
- fix hashing of the feature set (MR:583)
- support capability BPF, capability perfmon, capability checkpoint_restore regardless of kernel (MR:594, MR:654)
- Fix automatic addition of rules for access to change_hat interfaces for hats and parents (MR:625)
- Fix expansion of variables in unix rules addr= conditional (LP:1856738, MR:607)
- Fix variable expansion for mount type= and options= (AABUG:99, MR:638)
Utils
- genprof/logprof:
- Fix json mode when displaying local inactive profile (MR:516)
- Make call out to less use lists to properly handle odd filenames (MR:520)
- Improve error handling to not fail silently when reading profiles (MR:530)
- Correctly handle missing rules and children profiles (MR:539)
- Fix handling of degenerate quoted strings (MR:545)
- handle symlink log events (MR:587,AABUG:107)
- add CAPABILITIES BPF and PERFMON to severity.db (MR:589,MR:591,LP1890547)
Policy
-
Tunables
-
Abstractions
- hosts_access: add to support profiles that are using it (MR:612)
- dbus-network-manager-strict: support new abstraction (MR:409)
- enchant: support libenchant-2-2 (MR:572)
- fonts: update for Debian (MR:575,AABUG:94)
- gnome:
- mdns: allow /etc/mdns.allow (LP1869629)
- mesa: support i915 perf interface (MR:464)
- nameservice: nss-systemd, allow access to /run/systemd/userdb/ (AABUG:82)
- nvidia_modprobe:
- xdg-open and friends: support new abstraction (MR:404)
- vulkan: fix device and driver enumeration (MR:543)
- X: support X auth path $XDG_RUNTIME_DIR/xauth_XXXXXX (MR:581)
-
Profiles
Tests
- fix regression tests regex separator (MR:599)
- update tests to use assertEqual instead of the deprecated assertEquals (MR:347)
- fix test to run in cross-compiled environment without forcing parser rebuild (MR:465)
- fix python test dir for select tests (MR:574)
- profiles
- python utils
- Don't build syscall_sysctl test if missing kernel headers (AABUG:119, LP:1897288, MR:637)
Note
There is a semantic change in the 4.8 kernel (commit 9f834ec18defc369d73ccf9e87a2790bfa05bf46) that affects apparmor policy enforcement. Specifically it affects when the m permission bit is checked for elf binary executables. Policy and tests within apparmor 2.12 and later have been updated to support running on pre 4.8 and 4.8+ kernels.