AppArmor 2.13.3

Changes in this Release

Translations

sync to most up to date language translations available

Build Infrastructure

add files to .gitignore

swig auto generated files for ruby ([MR366][MR366])

fix libapparmor swig 4 failure 'aa_log_record' object has no attribute '__getattr__' ([BUG33][AABUG33])

libapparmor

fix segfault in overlaydirat_for_each causing overlayed cache directory failures
fix segfault when loading policy cache files
fix failure to merge overlay directories in some situations

Policy Compiler (a.k.a apparmor_parser)

clean up error handling ([dbug921866][dbug921866], [LP1815294][LP1815294])
fix parsing of target profile NAME in directed transitions “px -> NAME"
improve runtime attachment by determine xmatch priority based on smallest DFA match
don't skip cache loads just because optimizations flags are specified

Init

apparmor.systemd: fix minor issues detected by shellcheck
ensure error value is returned correctly ([MR352][MR352])

Utils

genprof/logprof
drop failing corner-case check in logparser.py ([bso1120472][bso1120472], [MR297][MR297])
drop unused get_profile_filename() from logparser.py ([MR297][MR297])
fix error KeyError: 'logfiles' when no logprof.conf exists ([MR365][MR365])
don't drop later events when user selects to deny a hat ([MR378][MR378])
update network keyword list and add corresponding tests ([MR350][MR350])

Policy

Profiles

dovecot

allow FD passing between dovecot and dovecot's anvil
allow chroot'ing the auth processes
let dovecot/anvil rw the auth-penalty socket
auth processes need to read from postfix auth socket
add abstractions/ssl_certs to lmtp
allow master to use SIGTERM on children that are slow to die
align {pop3,managesieve}-login to imap-login

identd: allow network netlink dgram ([MR353][MR353])
syslog-ng: add abstractions/python for python-parser
lsb_release profile: new abstraction
dnsmasq:

allow peer=libvirtd to support named profile
Work around breakage caused by {bin,sbin} alternation ([bso1127073][bso1127073], [MR346][MR346])
Revert /usr/{bin,sbin}/ alternation in dnsmasq profile name

msqld:

add mmap permission for mysqld (4.8 semantic change)
allow mysql to determine which cpus are online
allow locking of mysql files

Tunables

share:

make it play well with aliases
fix buggy syntax that broke the ~/.local/share part of the @{user_share_dirs} tunable

Abstractions

move dirc.d access from mesa to dir-common
base: allow mr permission on all .so common library paths
dri-common: allow reading /dev/dri/
ssl_certs,keys - add support for libdehydrated in /var/lib/
qt5: allow reading user configuration
qt5-settings-write: fix anonymous shared memory access
qt5-compose-cache-write: fix anonymous shared memory access
nameservice: allow access to /run/netconfig/resolv.conf ([bso1097370][bso1097370])
mesa: allow reading drirc.d
vulcan: allow reading /etc/vulkan/icd.d/ ([MR329][MR329])
nvidia: allow reading nvidia application profiles
postfix-common: make compatible with updated postfix profiles naming
python: allow reading /usr/local/lib/python3
ldapclient: allow rw access to the nslcd socket
ubuntu-browsers.d/multimedia: allow creating/writing config dirs
audio:

fix alsa settings access
grant read access to the system-wide asound.conf ([dbug920669][dbug920669], [MR320][MR320])
grant read access to the libao configuration files ([dbug920670][dbug920670], [MR320][MR320])

fonts:

Allow to read conf-avail dir itself.
Add various openSUSE-specific font config directories
allow creating/writing config dirs

kde:

allow access to common KDE-specific settings ([MR327][MR327])
allow access to global KDE settings ([MR327][MR327])

gnome:

allow reading gtk-3.0 cache files
allow creating config dirs

Tests

fix mount test to use next available loop device ([MR379][MR379])
update tests to support distros with user-merge where /bin and /sbin are symlinks ([MR331][MR331])
fix regression test failures around new binary cache layout
update tests for new network domain keywords
update tests for base abstraction changes

Documentation

apparmor.d (7):

update list of network domain keywords ([MR349][MR349])
drop unsupported 'to' option for link rules from manpage ([MR368][MR368])