| 2022-10-18 22:23:30 |
Georgia Garcia |
bug |
|
|
added bug |
| 2022-10-20 13:53:33 |
Georgia Garcia |
description |
[ Impact ]
We need to add IPC mediation support in the userspace tools, starting with posix message queue.
This would improve security and lower the attack surface for applications
There is already a proposal upstream:
https://gitlab.com/apparmor/apparmor/-/merge_requests/858
[ Test Plan ]
In the merge request in the description there are several tests added.
There are parser tests that can be run with "make -C parser check" in the project source tree.
There are also tests for the python tools that can be run ith "make -C utils check" in the project source tree.
There are also regression tests in tests/regression/apparmor. They run with the whole test suite when you run with "sudo make tests", but they can also be run individually with "sudo ./posix_mq.sh"
[ Where problems could occur ]
There could be problems related to #1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from
apparmor-3.0. |
[ Impact ]
We need to add IPC mediation support in the userspace tools, starting with posix message queue.
This would improve security and lower the attack surface for applications
There is already a proposal upstream:
https://gitlab.com/apparmor/apparmor/-/merge_requests/858
[ Test Plan ]
In the merge request in the description there are several tests added.
There are parser tests that can be run with "make -C parser check" in the project source tree.
There are also tests for the python tools that can be run ith "make -C utils check" in the project source tree.
There are also regression tests in tests/regression/apparmor. They run with the whole test suite when you run with "sudo make tests", but they can also be run individually with "sudo ./posix_mq.sh"
[ Where problems could occur ]
There could be problems related to Bug 1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from
apparmor-3.0. |
|
| 2022-12-06 09:43:53 |
Łukasz Zemczak |
apparmor (Ubuntu Jammy): status |
New |
Fix Committed |
|
| 2022-12-06 09:43:54 |
Łukasz Zemczak |
bug |
|
|
added subscriber Ubuntu Stable Release Updates Team |
| 2022-12-06 09:43:55 |
Łukasz Zemczak |
bug |
|
|
added subscriber SRU Verification |
| 2022-12-06 09:43:57 |
Łukasz Zemczak |
tags |
|
verification-needed verification-needed-jammy |
|
| 2022-12-06 10:01:49 |
Łukasz Zemczak |
apparmor (Ubuntu Focal): status |
New |
Fix Committed |
|
| 2022-12-06 10:01:52 |
Łukasz Zemczak |
tags |
verification-needed verification-needed-jammy |
verification-needed verification-needed-focal verification-needed-jammy |
|
| 2022-12-12 12:34:26 |
Georgia Garcia |
tags |
verification-needed verification-needed-focal verification-needed-jammy |
verification-done-focal verification-needed verification-needed-jammy |
|
| 2023-02-08 11:51:35 |
Georgia Garcia |
tags |
verification-done-focal verification-needed verification-needed-jammy |
verification-done verification-done-focal verification-done-jammy |
|
| 2023-03-14 00:18:06 |
Chris Halse Rogers |
removed subscriber Ubuntu Stable Release Updates Team |
|
|
|
| 2023-03-14 00:19:47 |
Launchpad Janitor |
apparmor (Ubuntu Jammy): status |
Fix Committed |
Fix Released |
|
| 2023-03-29 00:12:21 |
Launchpad Janitor |
apparmor (Ubuntu Focal): status |
Fix Committed |
Fix Released |
|
