lp://qastaging/apparmor/2.6

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #775785: out of free space on /tmp causes apparmor loosing protection on reload

Medium

Fix Committed

Link a bug report

Related blueprints

1706. By Steve Beattie on 2011-08-26

Merge from trunk revision 1805:

  Attached is a patch to make the initscript not fail if /tmp is full
  by converting the comm(1) usage on temporary files to an embedded
  awk script. On both Ubuntu and OpenSUSE, a version of awk (mawk in
  Ubuntu, gawk in OpenSUSE) is either a direct or indirect dependency
  on the minimal or base package set, and the original reporter also
  mentioned that an awk-based solution would be palatable in a way
  that converting to bash, or using perl or python here would not be.

  In the embedded awk script, I've tried to avoid gawk or mawk
  specific behaviors or extensions; e.g. this is the reason for the
  call to sort on the output of the awk script, rather than using
  gawk's asort(). But please let me know if you see anything that
  shouldn't be portable across awk implementations.

  An additional issue that is fixed in both scripts is handling
  child profiles (e.g. hats) during reload. If child profiles are
  filtered out (via grep -v '//') of the list to consider, then
  on reloading a profile where a child profile has been removed or
  renamed, that child profile will continue to stick around. However,
  if the profile containing child profiles is removed entirely,
  if the initscript attempts to unload the child profiles after the
  parent is removed, this will fail because they were unloaded when
  the parent was unloaded. Thus I removed any filtering of child
  profiles out, but do a post-awk reverse sort which guarantees that
  any child profiles will be removed before their parent is. I also
  added the LC_COLLATE=C (based on the Ubuntu version) to the sort
  call to ensure a consistent sort order.

  To restate, the problem with the existing code is that it creates
  temporary files in $TMPDIR (by default /tmp) and if that partition
  is full, problems with the reload action ensue. Alternate solutions
  include switching the initscript to use bash and its <$() extension
  or setting TMPDIR to /dev/shm/. The former is unpalatable to some
  (particularly for an initscript), and for the latter, /dev/shm is
  only guaranteed to exist on GNU libc based systems (glibc apparently
  expects /dev/shm to exist for its POSIX shared memory implementation;
  see shm_overview(7)). So to me, awk (sans GNU extensions) looks
  to be the least bad option here.

Nominated-By: Steve Beattie <email address hidden>
Acked-By: John Johansen <email address hidden>

1705. By Steve Beattie on 2011-08-17

Merge from trunk rev 1789: logprof and genprof were creating Px and
Cx execute permissions with the modifiers as lowercase (meaning to
pass on sensitive environment variables to the exec'ed process) even
if the user told them not to when prompted. This patch fixes the issue.

Nominated-by: Steve Beattie <email address hidden>
Acked-by: John Johansen <email address hidden>

1704. By Steve Beattie on 2011-08-04

Merge from trunk rev 1749: Actually skip loading profiles that we report
we're skipping.

From: Arkadiusz Miskiewicz <email address hidden>
Acked-By: Steve Beattie <email address hidden>

1703. By Jamie Strandboge on 2011-07-27

This is bug #815883. The dnsmasq profile needs to be updated for newer
libvirt. Patch is attached. The glob is needed since the lease file's
name is derived from the libvirt network name.

1702. By Steve Beattie on 2011-07-14

Merge from trunk rev 1740: Add
/usr/share/gnome/applications/mimeinfo.cache to gnome abstraction

Nominated-by: Jamie Strandboge <email address hidden>
Acked-By: Steve Beattie <email address hidden>

1701. By Steve Beattie on 2011-07-14

Merge from trunk rev 1737: allow owner read access to
/var/run/lightdm/authority/[0-9]* in the X abstraction

Nominated-by: Jamie Strandboge <email address hidden>
Acked-By: Steve Beattie <email address hidden>

1700. By John Johansen on 2011-06-06

Rename tags to remove use of ~

Rename tags
  apparmor_2.6.0~rc1 to apparmor_2.6.0-rc1
  apparmor_2.6.1~rc1 to apparmor_2.6.1-rc1

this is necessary for importing to the git mirror

Signed-off-by: John Johansen <email address hidden>

1699. By Steve Beattie on 2011-06-03

Merge from trunk commit 1721.1.2: This fixes a bug in sprintf use in
a few of the Perl tools, reported by Emanuel Bronshtein in LP: #781961.
                 Signed-off-by: Kees Cook <email address hidden>
Acked-By: Steve Beattie <email address hidden>

1698. By Steve Beattie on 2011-06-03

Merge from trunk rev 1733: Bug:
https://bugs.launchpad.net/apparmor/+bug/788616

This patch fixes the init scripts helper functions file to
filter out the hat/child process separator as currently used
by the parser, '//' rather than what used to be used, the '^'
symbol. This fixes bugs where profiles that covered regexs (e.g.
'/usr/lib/firefox-4.0.1/firefox{,*[^s][^h]}') and thus were being
improperly filtered away and unloaded when reloading apparmor policy.

Nominated-By: Steve Beattie <email address hidden>
Acked-By: Kees Cook <email address hidden>

1697. By Steve Beattie on 2011-06-03

Merge from trunk commit rev 1734:This patch adjusts the tag make
target to use a separate version with '~' replaced by '-'. This is
needed for mirroring to git as git can't handle '~'s embedded in tag
or branch names.

Tested by setting up a separate tag_version target like so:

tag_version:
 echo ${TAG_VERSION}

Nominated-By: Steve Beattie <email address hidden>
Acked-By: John Johansen <email address hidden>