This bug was fixed in the package apparmor - 3.0.0~beta1-0ubuntu6
---------------
apparmor (3.0.0~beta1-0ubuntu6) groovy; urgency=medium
* Drop d/p/lp1824812.patch: this patch was only needed with 2.13 and not
3.0. With AppArmor 3, the patch ends up setting SFS_MOUNTPOINT to the
wrong directory in is_container_with_internal_policy(), which causes
policy to always fail to load in containers. Thanks to Christian Ehrhardt
for the analysis. (LP: #1895967)
apparmor (3.0.0~beta1-0ubuntu5) groovy; urgency=medium
[ John Johansen ]
* d/p/fix-parser-to-emit-proc-attr-access-for-all-situations.patch:
fix-automatic-adding-of-rule-for-change-hat-iface.patch fixed the
parser to emit rules needed for change_hat in the hat profiles but
broke the rule being emitted for the parent profile, this fixes it for
both so that it is emitted for any profile that is a hat or that
contains a hat.
* d/p/fix-change-profile-stack-abstraction.patch: fix the change_profile
abstraction so that it allows access to the apparmor attribute paths
under LSM stacking.
apparmor (3.0.0~beta1-0ubuntu2) groovy; urgency=medium
[ John Johansen ]
* d/p/fix-automatic-adding-of-rule-for-change-hat-iface.patch: fix
parser not adding a rule to profiles if they are a hat or contain hats
granting write access to the kernel interfaces.
apparmor (3.0.0~beta1-0ubuntu1) groovy; urgency=medium
[ John Johansen ]
* New upstream release (LP: #1895060, LP: #1887577, LP: #1880841)
* Drop all patches backported from upstream: applied in 3.0
* d/p/policy-provide-example-and-base-abi-to-pin-pre-3.0-p.patch: provide
example and base abi to pin pre 3.0 policy
* d/p/ubuntu/enable-pinning-of-pre-AppArmor-3.x-poli.patch: enable pinning
of pre AppArmor 3.x policy
* drop d/p/debian/dont-include-site-local-with-dovecot.patch: no longer
needed with upstream 'include if exists'
[ Steve Beattie ]
* d/p/parser-fix_cap_match.patch: fix cap match to work correctly, important
now that groovy has a 5.8 kernel.
* d/apparmor-profiles.install:
+ adjust for renamed postfix profiles
+ add usr.bin.dumpcap and usr.bin.mlmmj-receive to extra-profiles
+ remove usr.sbin.nmbd and usr.sbin.smbd from extra-profiles (already in
apparmor-profiles)
* d/apparmor.install: include abi/ directory and tunables/etc.
* d/apparmor.manpages: add apparmor_xattrs.7 manpage
* d/control:
+ apparmor-utils: no more shipped perl tools, drop perl dependency
+ apparmor-notify: aa-notify was converted to python3 from perl; adjust
-notify dependencies to compensate
* d/p/fix-tests-regression-apparmor-prologue-inc-settest.patch:
fix sed expression in settest()
[ Emilia Torino ]
* Removing Ubuntu specific chromium-browser profile. This is safe to do
since groovy's chromium-browser deb installs the snap. If apparmor3
is backported to 18.04 or earlier, the profile will need to be taken
into consideration
- d/profiles/chromium-browser: remove chromium-browser profile
- d/apparmor-profiles.postinst: remove postinst script as it only
contains chromium-browser related functionallity.
- d/apparmor-profiles.postrm: remove postrm script as it only
contains chromium-browser related functionallity.
- d/apparmor-profiles.install: remove ubuntu-specific
chromium-browser abstraction and profile
- d/apparmor-profiles.lintian-overrides: remove chromium-browser
profile lintian overrides
- d/p/ubuntu/add-chromium-browser.patch: remove patch which added
chrome-browser
[ Alex Murray ]
* d/p/policy-provide-example-and-base-abi-to-pin-pre-3.0-p.patch: refresh
this patch with the official upstream version
* d/p/ubuntu/enable-pinning-of-pre-AppArmor-3.x-poli.patch: refresh this
patch to match the above
* d/p/parser-add-abi-warning-flags.patch: enable parser warnings
to be silenced or to be treated as errors
[ Jamie Strandboge ]
* d/p/adjust-for-ibus-1.5.22.patch: update ibus abstract path for ibus
1.5.22. This can be dropped with AppArmor 3.0 final.
* d/p/parser-add-abi-warning-flags.patch: refresh to avoid lintian warnings
* d/p/ubuntu/lp1891338.patch: adjust ubuntu-integration to use
abstractions/exo-open (LP: #1891338)
* d/p/ubuntu/lp1889699.patch: adjust to support brave in ubuntu
abstractions. Patch thanks to François Marier (LP: #1889699)
* d/p/ubuntu/lp1881357.patch: adjust for new ICEauthority path in /run
(LP: #1881357)
-- Jamie Strandboge <ja...@ubuntu.com> Tue, 22 Sep 2020 15:10:33 +0000
** Changed in: apparmor (Ubuntu)
Status: In Progress => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1880841
Title:
usr.sbin.nscd needs unix socket access to @userdb-*
Status in apparmor package in Ubuntu:
Fix Released
Bug description:
This concerns apparmor-profiles 2.13.3-7ubuntu5 in Ubuntu focal.
I use the usr.sbin.nscd profile in enforce mode, and am seeing the
following messages in /var/log/syslog . I don't know if the SIGABRT is
related:
May 27 04:39:56 test-ubuntu64 kernel: [ 199.392521] audit: type=1400
audit(1590568796.975:76): apparmor="DENIED" operation="bind" profile="nscd"
pid=1679 comm="nscd" family="unix" sock_type="dgram" protocol=0
requested_mask="bind" denied_mask="bind"
addr="@userdb-4a5d3fdcfb9afbd7fc75948800519358"
May 27 04:40:17 test-ubuntu64 systemd[1]: nscd.service: Main process exited,
code=killed, status=6/ABRT
May 27 04:40:17 test-ubuntu64 systemd[1]: nscd.service: Failed with result
'signal'.
May 27 04:40:17 test-ubuntu64 systemd[1]: nscd.service: Scheduled restart
job, restart counter is at 9.
The @userdb-* binding looks like a systemd thing. Should a rule for this go
into /etc/apparmor.d/abstractions/nameservice ?
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1880841/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
