abstractions/X needs new ICEauthority path
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
apparmor (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
This concerns apparmor 2.13.3-7ubuntu5 in Ubuntu focal.
Saw this during a Firefox test run:
May 29 17:25:32 test-ubuntu64 kernel: [ 818.399967] audit: type=1400 audit(159078753
This comparison was interesting:
$ ls -l ~/.ICEauthority /run/user/
-rw------- 1 skunk skunk 0 May 29 17:43 /home/skunk/
-rw------- 1 skunk skunk 350 May 29 17:43 /run/user/
Is the /run path a new canonical location for the ICEauthority file? The X abstraction would need to know about it.
This bug was fixed in the package apparmor - 3.0.0~beta1- 0ubuntu6
--------------- beta1-0ubuntu6) groovy; urgency=medium
apparmor (3.0.0~
* Drop d/p/lp1824812. patch: this patch was only needed with 2.13 and not with_internal_ policy( ), which causes
3.0. With AppArmor 3, the patch ends up setting SFS_MOUNTPOINT to the
wrong directory in is_container_
policy to always fail to load in containers. Thanks to Christian Ehrhardt
for the analysis. (LP: #1895967)
apparmor (3.0.0~ beta1-0ubuntu5) groovy; urgency=medium
[ John Johansen ] parser- to-emit- proc-attr- access- for-all- situations. patch: automatic- adding- of-rule- for-change- hat-iface. patch fixed the change- profile- stack-abstracti on.patch: fix the change_profile
* d/p/fix-
fix-
parser to emit rules needed for change_hat in the hat profiles but
broke the rule being emitted for the parent profile, this fixes it for
both so that it is emitted for any profile that is a hat or that
contains a hat.
* d/p/fix-
abstraction so that it allows access to the apparmor attribute paths
under LSM stacking.
apparmor (3.0.0~ beta1-0ubuntu2) groovy; urgency=medium
[ John Johansen ] automatic- adding- of-rule- for-change- hat-iface. patch: fix
* d/p/fix-
parser not adding a rule to profiles if they are a hat or contain hats
granting write access to the kernel interfaces.
apparmor (3.0.0~ beta1-0ubuntu1) groovy; urgency=medium
[ John Johansen ] provide- example- and-base- abi-to- pin-pre- 3.0-p.patch: provide enable- pinning- of-pre- AppArmor- 3.x-poli. patch: enable pinning dont-include- site-local- with-dovecot. patch: no longer
* New upstream release (LP: #1895060, LP: #1887577, LP: #1880841)
* Drop all patches backported from upstream: applied in 3.0
* d/p/policy-
example and base abi to pin pre 3.0 policy
* d/p/ubuntu/
of pre AppArmor 3.x policy
* drop d/p/debian/
needed with upstream 'include if exists'
[ Steve Beattie ] fix_cap_ match.patch: fix cap match to work correctly, important profiles. install: mlmmj-receive to extra-profiles profiles) manpages: add apparmor_xattrs.7 manpage tests-regressio n-apparmor- prologue- inc-settest. patch:
* d/p/parser-
now that groovy has a 5.8 kernel.
* d/apparmor-
+ adjust for renamed postfix profiles
+ add usr.bin.dumpcap and usr.bin.
+ remove usr.sbin.nmbd and usr.sbin.smbd from extra-profiles (already in
apparmor-
* d/apparmor.install: include abi/ directory and tunables/etc.
* d/apparmor.
* d/control:
+ apparmor-utils: no more shipped perl tools, drop perl dependency
+ apparmor-notify: aa-notify was converted to python3 from perl; adjust
-notify dependencies to compensate
* d/p/fix-
fix sed expression in settest()
[ Emilia Torino ] chromium- browser: remove chromium-browser profile profiles. postinst: remove postinst script as it only
* Removing Ubuntu specific chromium-browser profile. This is safe to do
since groovy's chromium-browser deb installs the snap. If apparmor3
is backported to 18.04 or earlier, the profile will need to be taken
into consideration
- d/profiles/
- d/apparmor-
contains chromium-browser related functionallity.
...