debian/0000755000000000000000000000000012035207742007170 5ustar debian/apparmor-profiles.dirs0000644000000000000000000000014211773263123013515 0ustar /etc/apparmor.d/local /etc/apparmor.d/abstractions/ubuntu-browsers.d /etc/apparmor.d/abstractions debian/libapache2-mod-apparmor.postrm0000644000000000000000000000027411773235147015037 0ustar #!/bin/sh set -e if [ "$1" = "purge" ]; then APP_PROFILE="usr.lib.apache2.mpm-prefork.apache2" rm -f /etc/apparmor.d/disable/$APP_PROFILE >/dev/null 2>&1 || true fi #DEBHELPER# debian/apparmor.dirs0000644000000000000000000000026711773235147011711 0ustar /etc/apparmor.d/cache /etc/apparmor.d/local /etc/apparmor.d/disable /etc/apparmor.d/force-complain /etc/apparmor.d/tunables/home.d /etc/apparmor.d/tunables/multiarch.d /lib/apparmor/ debian/po/0000755000000000000000000000000011773235147007616 5ustar debian/po/POTFILES.in0000644000000000000000000000004411773235147011371 0ustar [type: gettext/rfc822deb] templates debian/po/ja.po0000644000000000000000000000323011773235147010546 0ustar # Copyright (C) 2010 Kees Cook # This file is distributed under the same license as the apparmor package. # Hideki Yamane , 2011. # msgid "" msgstr "" "Project-Id-Version: apparmor 2.6.1-3\n" "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n" "POT-Creation-Date: 2010-01-05 17:45-0600\n" "PO-Revision-Date: 2011-05-03 10:52+0900\n" "Last-Translator: Hideki Yamane \n" "Language-Team: Japanese \n" "Language: ja\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" #. Type: string #. Description #: ../templates:1001 msgid "Additional home directory locations:" msgstr "追加のホームディレクトリの場所:" #. Type: string #. Description #: ../templates:1001 msgid "" "Please enter a space separated list of any additional locations for user " "home directories. These locations are in addition to those specified in /etc/" "apparmor.d/tunables/home and must end with a '/'." msgstr "" "空白で区切ったユーザのホームディレクトリの追加の場所一覧を入力してください。" "これらの場所は、/etc/apparmor.d/tunables/home で指定したものへの追加で、" "'/' で終わっている必要があります。" #. Type: string #. Description #: ../templates:1001 msgid "" "Example: if user's directories are stored in /srv/nfs/home and /mnt/homes, " "you should enter \"/srv/nfs/home/ /mnt/homes/\"." msgstr "" "例: ユーザのディレクトリが /srv/nfs/home と /mnt/homes に保存されている場合、" "「/srv/nfs/home/ /mnt/homes/」と入力する必要があります。" debian/po/es.po0000644000000000000000000000457211773235147010575 0ustar # apparmor po-debconf translation to Spanish # Copyright (C) 2011 Software in the Public Interest # This file is distributed under the same license as the apparmor package. # # Changes: # - Initial translation # Francisco Javier Cuadrado , 2011 # # Traductores, si no conocen el formato PO, merece la pena leer la # documentación de gettext, especialmente las secciones dedicadas a este # formato, por ejemplo ejecutando: # info -n '(gettext)PO Files' # info -n '(gettext)Header Entry' # # Equipo de traducción al español, por favor, lean antes de traducir # los siguientes documentos: # # - El proyecto de traducción de Debian al español # http://www.debian.org/intl/spanish/ # especialmente las notas de traducción en # http://www.debian.org/intl/spanish/notas # # - La guía de traducción de po's de debconf: # /usr/share/doc/po-debconf/README-trans # o http://www.debian.org/intl/l10n/po-debconf/README-trans # msgid "" msgstr "" "Project-Id-Version: apparmor 2.6.1-3\n" "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n" "POT-Creation-Date: 2010-01-05 17:45-0600\n" "PO-Revision-Date: 2011-05-06 13:45+0100\n" "Last-Translator: Francisco Javier Cuadrado \n" "Language-Team: Debian l10n Spanish \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" #. Type: string #. Description #: ../templates:1001 msgid "Additional home directory locations:" msgstr "Rutas adicionales de los directorios personales:" #. Type: string #. Description #: ../templates:1001 msgid "Please enter a space separated list of any additional locations for user home directories. These locations are in addition to those specified in /etc/apparmor.d/tunables/home and must end with a '/'." msgstr "Introduzca una lista separada por espacios con las rutas adicionales para los directorios personales. Estas rutas se suman a las indicadas en «/etc/apparmor.d/tunables/home» y deben terminar con una barra «/»." #. Type: string #. Description #: ../templates:1001 msgid "Example: if user's directories are stored in /srv/nfs/home and /mnt/homes, you should enter \"/srv/nfs/home/ /mnt/homes/\"." msgstr "Por ejemplo: si los directorios del usuario están ubicados en «/srv/nfs/home» y «/mnt/homes», debería introducir «/srv/nfs/home/ /mnt/homes/»." debian/po/sv.po0000644000000000000000000000320411773235147010605 0ustar # Translation of apparmor debconf template to Swedish # Copyright (C) 2011 Martin Bagge # This file is distributed under the same license as the apparmor package. # # Martin Bagge , 2011 msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n" "POT-Creation-Date: 2010-01-05 17:45-0600\n" "PO-Revision-Date: 2011-05-02 23:44+0100\n" "Last-Translator: Martin Bagge / brother \n" "Language-Team: Swedish \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=utf-8\n" "Content-Transfer-Encoding: 8bit\n" "X-Poedit-Language: Swedish\n" "X-Poedit-Country: Sweden\n" #. Type: string #. Description #: ../templates:1001 msgid "Additional home directory locations:" msgstr "Ytterligare sökvägar till hemkataloger:" #. Type: string #. Description #: ../templates:1001 msgid "" "Please enter a space separated list of any additional locations for user " "home directories. These locations are in addition to those specified in /etc/" "apparmor.d/tunables/home and must end with a '/'." msgstr "" "Ange en ytterligare sökvägar till användares hemkataloger separera med " "mellanslag. Dessa sökvägar är utöver de som anges i /etc/apparmor.d/tunables/" "home och måste sluta på \"/\"." #. Type: string #. Description #: ../templates:1001 msgid "" "Example: if user's directories are stored in /srv/nfs/home and /mnt/homes, " "you should enter \"/srv/nfs/home/ /mnt/homes/\"." msgstr "" "Exempel: Om användares hemkataloger finns i /srv/nfs/home och /mnt/homes så " "ska du ange \"/srv/nfs/home/ /mnt/homes/\"." debian/po/pt.po0000644000000000000000000000321611773235147010603 0ustar # Portuguese apparmor debconf translation # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER # This file is distributed under the same license as the apparmor package. # Pedro Ribeiro , 2011 # msgid "" msgstr "" "Project-Id-Version: apparmor 2.7.0~beta1+bzr1774-1\n" "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n" "POT-Creation-Date: 2010-01-05 17:45-0600\n" "PO-Revision-Date: 2011-12-06 00:05+0000\n" "Last-Translator: Pedro Ribeiro , 2011\n" "Language-Team: Portuguese \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" #. Type: string #. Description #: ../templates:1001 msgid "Additional home directory locations:" msgstr "Localizações adicionais para o directório home:" #. Type: string #. Description #: ../templates:1001 msgid "" "Please enter a space separated list of any additional locations for user " "home directories. These locations are in addition to those specified in /etc/" "apparmor.d/tunables/home and must end with a '/'." msgstr "" "Indique por favor uma lista de localizações adicionais para os directórios " "home de utilizador, separadas por espaços. Estas localizações serão " "acrescentadas às indicadas em /etc/apparmor.d/tunables/home e têm que " "terminar com '/'." #. Type: string #. Description #: ../templates:1001 msgid "" "Example: if user's directories are stored in /srv/nfs/home and /mnt/homes, " "you should enter \"/srv/nfs/home/ /mnt/homes/\"." msgstr "" "Exemplo: se os directórios de utilizador estiverem em /srv/nfs/home e " "/mnt/homes, deve indicar \"/srv/nfs/home/ /mnt/homes/\"." debian/po/fr.po0000644000000000000000000000337211773235147010572 0ustar # Translation of apparmor debconf templates to French # Copyright (C) 2011 Debian French l10n team # This file is distributed under the same license as the APPARMOR package. # Julien Patriarca , 2011. # msgid "" msgstr "" "Project-Id-Version: apparmor\n" "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n" "POT-Creation-Date: 2010-01-05 17:45-0600\n" "PO-Revision-Date: 2011-05-16 11:05+0100\n" "Last-Translator: Julien Patriarca \n" "Language-Team: FRENCH \n" "Language: fr\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" #. Type: string #. Description #: ../templates:1001 msgid "Additional home directory locations:" msgstr "Emplacement du répertoire personnel supplémentaire :" #. Type: string #. Description #: ../templates:1001 msgid "" "Please enter a space separated list of any additional locations for user " "home directories. These locations are in addition to those specified in /etc/" "apparmor.d/tunables/home and must end with a '/'." msgstr "" "Veuillez indiquer, séparés par des espaces, les emplacements des répertoires " "personnels (« home ») supplémentaires des utilisateurs. Ces répertoires " "seront ajoutés à ceux qui sont indiqués dans /etc/apparmor.d/tunables/home ; " "ils doivent se terminer par un « / »." #. Type: string #. Description #: ../templates:1001 msgid "" "Example: if user's directories are stored in /srv/nfs/home and /mnt/homes, " "you should enter \"/srv/nfs/home/ /mnt/homes/\"." msgstr "" "Exemple : si les répertoires des utilisateurs sont stockés dans /srv/nfs/" "home et /mnt/homes, vous devriez entrer « /srv/nfs/home/ /mnt/homes/ »." debian/po/it.po0000644000000000000000000000313011773235147010567 0ustar # Italian translation of apparmor'S PO-DEBCONF FILE. # Copyright (C) 2011 THE apparmor'S COPYRIGHT HOLDER # This file is distributed under the same license as the apparmor package. # Dario Santamaria , 2011. # msgid "" msgstr "" "Project-Id-Version: 2.6.1-3\n" "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n" "POT-Creation-Date: 2010-01-05 17:45-0600\n" "PO-Revision-Date: 2011-05-04 00:01+0200\n" "Last-Translator: Dario Santamaria \n" "Language-Team: Italian \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=utf-8\n" "Content-Transfer-Encoding: 8bit\n" #. Type: string #. Description #: ../templates:1001 msgid "Additional home directory locations:" msgstr "Posizioni aggiuntive per directory home:" #. Type: string #. Description #: ../templates:1001 msgid "" "Please enter a space separated list of any additional locations for user " "home directories. These locations are in addition to those specified in /etc/" "apparmor.d/tunables/home and must end with a '/'." msgstr "" "Inserire un elenco separato da spazi di posizioni aggiuntive per le directory " "home utente. Questi percorsi vanno ad aggiungersi a quelli specificati in " "/etc/apparmor.d/tunables/home e devono terminare con una «/»." #. Type: string #. Description #: ../templates:1001 msgid "" "Example: if user's directories are stored in /srv/nfs/home and /mnt/homes, " "you should enter \"/srv/nfs/home/ /mnt/homes/\"." msgstr "" "Esempio: se le directory home utente si trovano in /srv/nfs/home e " "/mnt/homes, inserire \"/srv/nfs/home/ /mnt/homes/\"." debian/po/de.po0000644000000000000000000000316411773235147010552 0ustar # German translation of apparmor. # This file is distributed under the same license as the apparmor package. # Copyright (C) Chris Leick , 2011. # msgid "" msgstr "" "Project-Id-Version: apparmor 2.6.1-3\n" "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n" "POT-Creation-Date: 2010-01-05 17:45-0600\n" "PO-Revision-Date: 2011-05-02 23:05+0100\n" "Last-Translator: Chris Leick \n" "Language-Team: Debian German \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" #. Type: string #. Description #: ../templates:1001 msgid "Additional home directory locations:" msgstr "Zusätzliche Speicherorte für Home-Verzeichnisse:" #. Type: string #. Description #: ../templates:1001 msgid "" "Please enter a space separated list of any additional locations for user " "home directories. These locations are in addition to those specified in /etc/" "apparmor.d/tunables/home and must end with a '/'." msgstr "" "Bitte geben Sie eine durch Leerzeichen getrennte Liste zusätzlicher " "Speicherorte für die Home-Verzeichnisse der Benutzer ein. Diese Speicherorte " "ergänzen die, die in /etc/apparmor.d/tunables/home angegeben sind und müssen " "mit einem »/« enden." #. Type: string #. Description #: ../templates:1001 msgid "" "Example: if user's directories are stored in /srv/nfs/home and /mnt/homes, " "you should enter \"/srv/nfs/home/ /mnt/homes/\"." msgstr "" "Beispiel: Falls die Verzeichnisse der Anwender in /srv/nfs/home und " "/mnt/homes gespeichert sind, sollten Sie »/srv/nfs/home/ /mnt/homes/« " "eingeben." debian/po/ru.po0000644000000000000000000000366411773235147010615 0ustar # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER # This file is distributed under the same license as the apparmor package. # # Yuri Kozlov , 2011. msgid "" msgstr "" "Project-Id-Version: apparmor 2.6.1-2\n" "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n" "POT-Creation-Date: 2010-01-05 17:45-0600\n" "PO-Revision-Date: 2011-05-01 10:19+0400\n" "Last-Translator: Yuri Kozlov \n" "Language-Team: Russian \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" "X-Generator: Lokalize 1.0\n" "Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && " "n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n" #. Type: string #. Description #: ../templates:1001 msgid "Additional home directory locations:" msgstr "Дополнительные места расположения домашних каталогов:" #. Type: string #. Description #: ../templates:1001 msgid "" "Please enter a space separated list of any additional locations for user " "home directories. These locations are in addition to those specified in /etc/" "apparmor.d/tunables/home and must end with a '/'." msgstr "" "Введите через пробел дополнительные места расположения " "домашних каталогов пользователей. " "Эти места добавятся к указанным в /etc/apparmor.d/tunables/home " "и должны заканчиваться символом «/»." #. Type: string #. Description #: ../templates:1001 msgid "" "Example: if user's directories are stored in /srv/nfs/home and /mnt/homes, " "you should enter \"/srv/nfs/home/ /mnt/homes/\"." msgstr "" "Пример: если домашние каталоги пользователей находятся в /srv/nfs/home и " "/mnt/homes, " "то введите «/srv/nfs/home/ /mnt/homes/»." debian/po/templates.pot0000644000000000000000000000223511773235147012342 0ustar # SOME DESCRIPTIVE TITLE. # Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER # This file is distributed under the same license as the PACKAGE package. # FIRST AUTHOR , YEAR. # #, fuzzy msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n" "POT-Creation-Date: 2010-01-05 17:45-0600\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=CHARSET\n" "Content-Transfer-Encoding: 8bit\n" #. Type: string #. Description #: ../templates:1001 msgid "Additional home directory locations:" msgstr "" #. Type: string #. Description #: ../templates:1001 msgid "" "Please enter a space separated list of any additional locations for user " "home directories. These locations are in addition to those specified in /etc/" "apparmor.d/tunables/home and must end with a '/'." msgstr "" #. Type: string #. Description #: ../templates:1001 msgid "" "Example: if user's directories are stored in /srv/nfs/home and /mnt/homes, " "you should enter \"/srv/nfs/home/ /mnt/homes/\"." msgstr "" debian/po/da.po0000644000000000000000000000306311773235147010544 0ustar # Danish translation apparmor. # Copyright (C) 2011 apparmor & nedenstående oversættere. # This file is distributed under the same license as the apparmor package. # Joe Hansen , 2011. # msgid "" msgstr "" "Project-Id-Version: apparmor\n" "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n" "POT-Creation-Date: 2010-01-05 17:45-0600\n" "PO-Revision-Date: 2011-05-02 17:30+01:00\n" "Last-Translator: Joe Hansen \n" "Language-Team: Danish \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" #. Type: string #. Description #: ../templates:1001 msgid "Additional home directory locations:" msgstr "Yderligere placeringer af hjemmemapper:" #. Type: string #. Description #: ../templates:1001 msgid "" "Please enter a space separated list of any additional locations for user " "home directories. These locations are in addition to those specified in /etc/" "apparmor.d/tunables/home and must end with a '/'." msgstr "" "Indtast venligst en mellemrumsadskilt liste af alle yderligere placeringer for " "brugerhjemmemapper. Disse placeringer er udover de i /etc/apparmor.d/tunables/home " "angivne og skal afsluttes med et »/«." #. Type: string #. Description #: ../templates:1001 msgid "" "Example: if user's directories are stored in /srv/nfs/home and /mnt/homes, " "you should enter \"/srv/nfs/home/ /mnt/homes/\"." msgstr "" "Eksempel: Hvis brugerens mapper er gemt i /srv/nfs/home og /mnt/homes, " "skal du indtaste »/srv/nfs/home/ /mnt/homes/«." debian/po/zh_CN.po0000644000000000000000000000305711773235147011164 0ustar # Simplified Chinese translation of apparmor debconf. # Copyright (C) 2011 Free Software Foundation, Inc. # This file is distributed under the same license as the apparmor package. # Aron Xu , 2011. # msgid "" msgstr "" "Project-Id-Version: apparmor 2.6.1-3\n" "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n" "POT-Creation-Date: 2010-01-05 17:45-0600\n" "PO-Revision-Date: 2011-05-02 15:53+0800\n" "Last-Translator: Aron Xu \n" "Language-Team: Chinese (simplified) \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" #. Type: string #. Description #: ../templates:1001 msgid "Additional home directory locations:" msgstr "附加主目录位置：" #. Type: string #. Description #: ../templates:1001 msgid "" "Please enter a space separated list of any additional locations for user " "home directories. These locations are in addition to those specified in /etc/" "apparmor.d/tunables/home and must end with a '/'." msgstr "" "请输入用户主目录位置，多个位置请使用空格分隔。这些位置将作为 " "/etc/apparmor.d/tunables/home 中已指定的目录的补充，每个目录必须以“/”结尾。" #. Type: string #. Description #: ../templates:1001 msgid "" "Example: if user's directories are stored in /srv/nfs/home and /mnt/homes, " "you should enter \"/srv/nfs/home/ /mnt/homes/\"." msgstr "" "例如：如果用户目录存放于 /srv/nfs/home 和 /mnt/homes，您应当输入" "“/srv/nfs/home/ /mnt/homes/”。" debian/po/cs.po0000644000000000000000000000320211773235147010560 0ustar # Czech PO debconf template translation of apparmor. # Copyright (C) 2010 Michal Simunek # This file is distributed under the same license as the apparmor package. # Michal Simunek , 2011. # msgid "" msgstr "" "Project-Id-Version: apparmor 2.6.1-3\n" "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n" "POT-Creation-Date: 2010-01-05 17:45-0600\n" "PO-Revision-Date: 2011-05-03 17:31+0200\n" "Last-Translator: Michal Simunek \n" "Language-Team: Czech \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=utf-8\n" "Content-Transfer-Encoding: 8bit\n" #. Type: string #. Description #: ../templates:1001 msgid "Additional home directory locations:" msgstr "Další umístění domovských adresářů:" #. Type: string #. Description #: ../templates:1001 msgid "" "Please enter a space separated list of any additional locations for user " "home directories. These locations are in addition to those specified in /etc/" "apparmor.d/tunables/home and must end with a '/'." msgstr "" "Zadejte prosím mezerami oddělený seznam všech dalších umístění pro domovské " "adresáře uživatelů. Tato umístění rozšiřují ta, která jsou uvedena v /etc/" "apparmor.d/tunables/home a musí být zakončena '/'." #. Type: string #. Description #: ../templates:1001 msgid "" "Example: if user's directories are stored in /srv/nfs/home and /mnt/homes, " "you should enter \"/srv/nfs/home/ /mnt/homes/\"." msgstr "" "Nacházejí-li se například adresáře uživatelů v /srv/nfs/home a /mnt/homes, " "zadejte \"/srv/nfs/home/ /mnt/homes/\"." debian/po/nl.po0000644000000000000000000000316411773235147010573 0ustar # Dutch translation of apparmor debconf templates. # Copyright (C) 2011 THE PACKAGE'S COPYRIGHT HOLDER # This file is distributed under the same license as the apparmor package. # Jeroen Schot , 2011. # msgid "" msgstr "" "Project-Id-Version: apparmor_2.6.1-3\n" "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n" "POT-Creation-Date: 2010-01-05 17:45-0600\n" "PO-Revision-Date: 2011-05-10 14:17+0200\n" "Last-Translator: Jeroen Schot \n" "Language-Team: Debian l10n Dutch \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" "Language: nl\n" #. Type: string #. Description #: ../templates:1001 msgid "Additional home directory locations:" msgstr "Extra locaties van thuismappen:" #. Type: string #. Description #: ../templates:1001 msgid "" "Please enter a space separated list of any additional locations for user " "home directories. These locations are in addition to those specified in /etc/" "apparmor.d/tunables/home and must end with a '/'." msgstr "" "Voer alstublieft een door spaties gescheiden lijst van extra " "thuismappen van gebruikers in. Deze locaties zijn een toevoeging op die in /etc/" "apparmor.d/tunables/home en moeten met een '/' eindigen." #. Type: string #. Description #: ../templates:1001 msgid "" "Example: if user's directories are stored in /srv/nfs/home and /mnt/homes, " "you should enter \"/srv/nfs/home/ /mnt/homes/\"." msgstr "" "Voorbeeld: Als de thuismappen van gebruikers zich in /srv/nfs/home " "en /mnt/homes bevinden dient u \"/srv/nfs/home/ /mnt/homes/\" in te voeren." debian/non-linux/0000755000000000000000000000000011773235147011127 5ustar debian/non-linux/apparmor_parser0000755000000000000000000000006111773235147014247 0ustar #!/bin/sh echo "AppArmor unavailable" >&2 exit 1 debian/libpam-apparmor.install0000644000000000000000000000003511773235147013651 0ustar lib/security/pam_apparmor.so debian/libapache2-mod-apparmor.dirs0000644000000000000000000000006211773235147014447 0ustar /etc/apparmor.d/apache2.d /etc/apparmor.d/disable debian/put-all-profiles-in-complain-mode.sh0000644000000000000000000000102011773235147016052 0ustar #!/bin/sh PROFILE_DIR="./etc/apparmor.d" for f in ${PROFILE_DIR}/* do [ ! -f "$f" ] && continue if egrep -q 'flags=\(.*\) {' "$f"; then # Deal with existing flags, but need to account for multiple # profiles in one file and not all of them having the same # flags. grep -q 'flags=(complain)' "$f" && continue sed -i -e 's/flags=(\(.*\)) {$/flags=(complain,\1) {/' -e 's/ {$/ flags=(complain) {/' -e 's/) flags=(complain) {/) {/' "$f" else # No existing flags sed -i 's/ {$/ flags=(complain) {/' "$f" fi done debian/libapparmor-perl.install0000644000000000000000000000002011773235147014030 0ustar usr/lib/perl5/* debian/libapparmor-dev.install0000644000000000000000000000012211773235147013647 0ustar usr/lib/libapparmor.a usr/lib/libapparmor.la usr/lib/libapparmor.so usr/include/* debian/apparmor.prerm0000644000000000000000000000127411773235147012074 0ustar #!/bin/sh # prerm script for apparmor # # see: dh_installdeb(1) set -e # summary of how this script can be called: # * `remove' # * `upgrade' # * `failed-upgrade' # * `remove' `in-favour' # * `deconfigure' `in-favour' # `removing' # # for details, see http://www.debian.org/doc/debian-policy/ or # the debian-policy package # dh_installdeb will replace this with shell code automatically # generated by other debhelper scripts. #DEBHELPER# exit 0 debian/apport/0000755000000000000000000000000011773235147010505 5ustar debian/apport/source_apparmor.py0000644000000000000000000000332111773235147014257 0ustar '''apport package hook for apparmor (c) 2009 Canonical Ltd. Author: Steve Beattie License: GPLv2 ''' from apport.hookutils import * from os import path import re def recent_kernlog(pattern): '''Extract recent messages from kern.log or message which match a regex. pattern should be a "re" object. ''' lines = '' if os.path.exists('/var/log/kern.log'): file = '/var/log/kern.log' elif os.path.exists('/var/log/messages'): file = '/var/log/messages' else: return lines for line in open(file): if pattern.search(line): lines += line return lines def add_info(report): attach_file(report, '/proc/version_signature', 'ProcVersionSignature') attach_file(report, '/proc/cmdline', 'ProcKernelCmdline') sec_re = re.compile('audit\(|apparmor|selinux|security', re.IGNORECASE) report['KernLog'] = recent_kernlog(sec_re) packages=['apparmor', 'apparmor-utils', 'libapparmor1', 'libapparmor-dev', 'libapparmor-perl', 'apparmor-utils', 'apparmor-docs', 'apparmor-profiles', 'libapache2-mod-apparmor', 'libpam-apparmor', 'auditd', 'libaudit0'] versions = '' for package in packages: try: version = packaging.get_version(package) except ValueError: version = 'N/A' if version is None: version = 'N/A' versions += '%s %s\n' % (package, version) report['ApparmorPackages'] = versions # These need to be run as root report['ApparmorStatusOutput'] = root_command_output(['/usr/sbin/apparmor_status']) report['PstreeP'] = command_output(['/usr/bin/pstree', '-p']) attach_file_if_exists(report, '/var/log/audit/audit.log', 'audit.log') debian/apparmor.install0000644000000000000000000000063711773235147012417 0ustar debian/apport/source_apparmor.py /usr/share/apport/package-hooks/ debian/lib/apparmor/functions /lib/apparmor/ etc/apparmor/subdomain.conf sbin/apparmor_parser usr/sbin/aa-status usr/sbin/apparmor_status etc/apparmor.d/tunables/alias etc/apparmor.d/tunables/global etc/apparmor.d/tunables/home etc/apparmor.d/tunables/proc etc/apparmor.d/tunables/multiarch etc/apparmor.d/abstractions/* etc/apparmor.d/local/README debian/libapache2-mod-apparmor.lintian-overrides0000644000000000000000000000021511773256051017141 0ustar # compile-time safe memset via apr_* macros. libapache2-mod-apparmor: hardening-no-fortify-functions usr/lib/apache2/modules/mod_apparmor.so debian/apparmor-notify.install0000644000000000000000000000017211773235147013717 0ustar debian/notify/90apparmor-notify /etc/X11/Xsession.d/ usr/sbin/aa-notify /usr/bin/ etc/apparmor/notify.conf /etc/apparmor/ debian/debhelper/0000755000000000000000000000000011773260065011127 5ustar debian/debhelper/postinst-apparmor0000644000000000000000000000144611773235633014564 0ustar if [ "$1" = "configure" ]; then APP_PROFILE=/etc/apparmor.d/#PROFILE# if [ -f "$APP_PROFILE" ]; then # Add the local/ include LOCAL_APP_PROFILE=/etc/apparmor.d/local/#PROFILE# test -e "$LOCAL_APP_PROFILE" || { tmp=`mktemp` cat < "$tmp" # Site-specific additions and overrides for #PROFILE#. # For more details, please see /etc/apparmor.d/local/README. EOM mkdir `dirname $LOCAL_APP_PROFILE` 2>/dev/null || true mv -f "$tmp" "$LOCAL_APP_PROFILE" chmod 644 "$LOCAL_APP_PROFILE" } # Reload the profile, including any abstraction updates if [ -x /usr/sbin/aa-status ] && aa-status --enabled 2>/dev/null; then apparmor_parser -r -T -W "$APP_PROFILE" || true fi fi fi debian/debhelper/postrm-apparmor0000644000000000000000000000037211773235147014222 0ustar if [ "$1" = "purge" ]; then rm -f "/etc/apparmor.d/disable/#PROFILE#" || true rm -f "/etc/apparmor.d/force-complain/#PROFILE#" || true rm -f "/etc/apparmor.d/local/#PROFILE#" || true rmdir /etc/apparmor.d/local 2>/dev/null || true fi debian/debhelper/dh_apparmor0000644000000000000000000000264511773235147013360 0ustar #!/usr/bin/perl -w =head1 NAME dh_apparmor - reload AppArmor profile and create local include =cut use strict; use Debian::Debhelper::Dh_Lib; =head1 SYNOPSIS B B<--profile-name=>I =head1 DESCRIPTION dh_apparmor is a debhelper program that will create/remove the /etc/apparmor.d/local/ include file in maintainer scripts. It also reloads the specified AppArmor profile in postinst using: =over 4 apparmor_parser -r -W -T /etc/apparmor.d/ =back By using '-W -T' we ensure that any abstraction updates are also pulled in. =head1 OPTIONS =over 4 =item B<--profile-name=> Specify the profile name. =back =head1 NOTES Note that for packages that have multiple binary packages, you will want to pass '-p' to dh_apparmor, otherwise dh_apparmor will add AppArmor reload commands for all packages rather than just the one that ships the profile. =cut init(options => { "profile-name=s" => \$dh{PROFILE_NAME}, }); foreach my $package (@{$dh{DOPACKAGES}}) { if (! $dh{PROFILE_NAME}) { error("Must specify --profile-name"); } my $pname = $dh{PROFILE_NAME}; autoscript($package,"postinst","postinst-apparmor","s/#PROFILE#/$pname/"); autoscript($package,"postrm","postrm-apparmor","s/#PROFILE#/$pname/"); } =head1 SEE ALSO L This program is a part of debhelper. =head1 AUTHOR Jamie Strandboge =cut debian/templates0000644000000000000000000000064611773235147011127 0ustar Template: apparmor/homedirs Type: string _Description: Additional home directory locations: Please enter a space separated list of any additional locations for user home directories. These locations are in addition to those specified in /etc/apparmor.d/tunables/home and must end with a '/'. . Example: if user's directories are stored in /srv/nfs/home and /mnt/homes, you should enter "/srv/nfs/home/ /mnt/homes/". debian/vim-apparmor.yaml0000644000000000000000000000014611773235147012477 0ustar addon: apparmor description: "syntax highlighting for AppArmor files" files: - syntax/apparmor.vim debian/apparmor.manpages0000644000000000000000000000047211773235147012541 0ustar debian/tmp/usr/share/man/man5/subdomain.conf.5 debian/tmp/usr/share/man/man5/apparmor.vim.5 debian/tmp/usr/share/man/man5/apparmor.d.5 debian/tmp/usr/share/man/man8/apparmor_parser.8 debian/tmp/usr/share/man/man7/apparmor.7 debian/tmp/usr/share/man/man8/aa-status.8 debian/tmp/usr/share/man/man8/apparmor_status.8 debian/libapparmor1.manpages0000644000000000000000000000027511773235147013312 0ustar debian/tmp/usr/share/man/man2/aa_change_hat.2 debian/tmp/usr/share/man/man2/aa_change_profile.2 debian/tmp/usr/share/man/man2/aa_find_mountpoint.2 debian/tmp/usr/share/man/man2/aa_getcon.2 debian/apparmor-utils.install0000644000000000000000000000125011773235147013545 0ustar debian/aa-update-browser /usr/sbin/ debian/vim-apparmor.yaml /usr/share/vim/registry/ usr/share/apparmor/apparmor.vim /usr/share/vim/addons/syntax/ etc/apparmor/easyprof.conf etc/apparmor/logprof.conf etc/apparmor/severity.db usr/bin/aa-easyprof usr/lib/python*.*/site-packages/apparmor* usr/share/perl5/Immunix/AppArmor.pm usr/share/perl5/Immunix/Repository.pm usr/share/perl5/Immunix/Config.pm usr/share/perl5/Immunix/Severity.pm usr/sbin/aa-complain usr/sbin/aa-decode usr/sbin/aa-exec usr/sbin/aa-genprof usr/sbin/aa-audit usr/sbin/aa-logprof usr/sbin/aa-autodep usr/sbin/aa-unconfined usr/sbin/aa-enforce usr/sbin/aa-disable usr/share/apparmor/easyprof/ /usr/share/apparmor/ debian/libapparmor1.install0000644000000000000000000000003211773235147013154 0ustar usr/lib/libapparmor.so.1* debian/apparmor.config0000644000000000000000000000017411773235147012212 0ustar #!/bin/sh set -e # debconf . /usr/share/debconf/confmodule db_version 2.0 db_input medium apparmor/homedirs || true db_go debian/compat0000644000000000000000000000000211773235147010376 0ustar 9 debian/lib/0000755000000000000000000000000011773235147007746 5ustar debian/lib/apparmor/0000755000000000000000000000000011773235147011567 5ustar debian/lib/apparmor/functions0000644000000000000000000000575211773235147013533 0ustar # /lib/apparmor/functions for Debian -*- shell-script -*- # ---------------------------------------------------------------------- # Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 # NOVELL (All rights reserved) # Copyright (c) 2008-2010 Canonical, Ltd. # # This program is free software; you can redistribute it and/or # modify it under the terms of version 2 of the GNU General Public # License published by the Free Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, contact Novell, Inc. # ---------------------------------------------------------------------- # Authors: # Kees Cook PROFILES="/etc/apparmor.d" PARSER="/sbin/apparmor_parser" SECURITYFS="/sys/kernel/security" export AA_SFS="$SECURITYFS/apparmor" # Suppress warnings when booting in quiet mode quiet_arg="" [ "${QUIET:-no}" = yes ] && quiet_arg="-q" [ "${quiet:-n}" = y ] && quiet_arg="-q" foreach_configured_profile() { (ls -1 "$PROFILES" | egrep -v '(\.dpkg-(new|old|dist|bak)|~)$' | \ while read profile; do if [ -f "$PROFILES"/"$profile" ]; then echo "$PROFILES"/"$profile" fi done) | \ xargs -n1 -d"\n" -P$(getconf _NPROCESSORS_ONLN) "$PARSER" "$@" -- } load_configured_profiles() { clear_cache_if_outdated foreach_configured_profile $quiet_arg --write-cache --replace } load_configured_profiles_without_caching() { foreach_configured_profile $quiet_arg --replace } recache_profiles() { clear_cache foreach_configured_profile $quiet_arg --write-cache --skip-kernel-load } configured_profile_names() { foreach_configured_profile $quiet_arg -N 2>/dev/null | LC_COLLATE=C sort | grep -v '//' } running_profile_names() { # Output a sorted list of loaded profiles, skipping libvirt's # dynamically generated files if [ -r "$AA_SFS"/profiles ]; then cat "$AA_SFS"/profiles | sed -e "s/ (\(enforce\|complain\))$//" | egrep -v '^libvirt-[0-9a-f\-]+$' | LC_COLLATE=C sort | grep -v '//' fi } unload_profile() { echo -n "$1" > "$AA_SFS"/.remove } clear_cache() { find "$PROFILES"/cache -maxdepth 1 -type f -print0 | xargs -0 rm -f -- } read_features_dir() { for f in `ls -AU "$1"` ; do if [ -f "$1/$f" ] ; then read -r KF < "$1/$f" || true echo -n "$f {$KF } " elif [ -d "$1/$f" ] ; then echo -n "$f {" KF=`read_features_dir "$1/$f"` || true echo -n "$KF} " fi done } clear_cache_if_outdated() { if [ -r "$PROFILES"/cache/.features ]; then if [ -d "$AA_SFS"/features ]; then KERN_FEATURES=`read_features_dir "$AA_SFS"/features` else read -r KERN_FEATURES < "$AA_SFS"/features fi CACHE_FEATURES=`tr '\n' ' ' < "$PROFILES"/cache/.features` if [ "$KERN_FEATURES" != "$CACHE_FEATURES" ]; then clear_cache fi fi } debian/etc/0000755000000000000000000000000011773235147007753 5ustar debian/etc/apache2/0000755000000000000000000000000011773235147011256 5ustar debian/etc/apache2/mods-available/0000755000000000000000000000000011773235147014136 5ustar debian/etc/apache2/mods-available/apparmor.load0000644000000000000000000000010411773235147016613 0ustar LoadModule apparmor_module /usr/lib/apache2/modules/mod_apparmor.so debian/source/0000755000000000000000000000000011773235147010500 5ustar debian/source/format0000644000000000000000000000001411773235147011706 0ustar 3.0 (quilt) debian/libapache2-mod-apparmor.postinst0000644000000000000000000000224611773235147015377 0ustar #!/bin/sh # postinst script for libapache2-mod-apparmor # # see: dh_installdeb(1) set -e # summary of how this script can be called: # * `configure' # * `abort-upgrade' # * `abort-remove' `in-favour' # # * `abort-remove' # * `abort-deconfigure' `in-favour' # `removing' # # for details, see http://www.debian.org/doc/debian-policy/ or # the debian-policy package case "$1" in configure) APP_PROFILE="/etc/apparmor.d/usr.lib.apache2.mpm-prefork.apache2" if [ -f "$APP_PROFILE" ] && aa-status --enabled 2>/dev/null; then apparmor_parser -rTW "$APP_PROFILE" || true fi ;; abort-upgrade|abort-remove|abort-deconfigure) ;; *) echo "postinst called with unknown argument \`$1'" >&2 exit 1 ;; esac # dh_installdeb will replace this with shell code automatically # generated by other debhelper scripts. #DEBHELPER# exit 0 debian/copyright0000644000000000000000000001214111773235147011132 0ustar Format: http://svn.debian.org/wsvn/dep/web/deps/dep5.mdwn?op=file&rev=166 Upstream-Name: AppArmor Upstream-Contact: apparmor@lists.ubuntu.com Source: https://launchpad.net/apparmor Files: * Copyright: 1998-2007 Novell/SuSE/Immunix 2007-2011 Canonical Ltd. License: GPL-2 Files: changehat/pam_apparmor/* Copyright: 2006 SUSE Linux Products GmbH, Nuernberg, Germany 2002, 2003, 2004 SuSE GmbH Nuernberg, Germany 2002-2006 Novell/SuSE 2010 Canonical Ltd. License: BSD-3-clause or GPL-2+ Files: changehat/mod_apparmor/* libraries/libapparmor/* parser/libapparmor_re/apparmor_re.h Copyright: 1999-2008 Novell 2009-2010 Canonical Ltd. License: LGPL-2.1+ Files: profiles/enabled/sbin.syslog-ng Copyright: 2006 Novell, Christian Boltz License: GPL-2 Files: profiles/apparmor/profiles/extras/usr.bin.mlmmj-make-ml.sh Copyright: 2002-2005 Novell/SUSE License: GPL-2 Files: profiles/extras/usr.bin.passwd Copyright: 2006 Novell, Volker Kuhlmann License: GPL-2 Files: libraries/libapparmor/ltmain.sh Copyright: 1996, 1997, 1998, 1999, 2000, 2001, 2003, 2004, 2005, 2006, 2007 2008 Free Software Foundation, Inc. License: GPL-2+ Files: deprecated/management/profile-editor/* Copyright: 2006 Novell Matt Barringer 1998-2003 by Neil Hodgson Robin Dunn License: GPL-2+ Files: deprecated/management/apparmor-dbus/* Copyright: 2006 Novell Matt Barringer License: GPL-2+ Files: deprecated/management/profile-editor/src/wxStyledTextCtrl/StyleContext.* Copyright: 1998-2004 Neil Hodgson License: public-domain This file is in the public domain. Files: deprecated/management/profile-editor/src/wxStyledTextCtrl/RESearch.h Copyright: Neil Hodgson Ozan S. Yigit License: public-domain This file is in the public domain. Files: debian/* Copyright: 2007-2011 Canonical Ltd. License: GPL-2 License: GPL-2 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; version 2 of the License. . This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. . You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. . On Debian systems, the complete text of the GNU General Public License can be found in `/usr/share/common-licenses/GPL-2'. License: GPL-2+ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. . This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. . You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. . On Debian systems, the complete text of the GNU General Public License can be found in `/usr/share/common-licenses/GPL-2'. License: LGPL-2.1+ This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version. . This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. . You should have received a copy of the GNU Lesser General Public License along with this library; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA . On Debian systems, the complete text of the GNU General Public License can be found in `/usr/share/common-licenses/LGPL-2.1'. License: BSD-3-clause Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: . 1. Redistributions of source code must retain any existing copyright notice, and this entire permission notice in its entirety, including the disclaimer of warranties. . 2. Redistributions in binary form must reproduce all prior and current copyright notices, this list of conditions, and the following disclaimer in the documentation and/or other materials provided with the distribution. . 3. The name of any author may not be used to endorse or promote products derived from this software without their specific prior written permission. debian/clean0000644000000000000000000000241311773235147010205 0ustar libraries/libapparmor/config.guess libraries/libapparmor/config.sub libraries/libapparmor/ltmain.sh libraries/libapparmor/Makefile.in libraries/libapparmor/aclocal.m4 libraries/libapparmor/compile libraries/libapparmor/configure libraries/libapparmor/depcomp libraries/libapparmor/install-sh libraries/libapparmor/missing libraries/libapparmor/py-compile libraries/libapparmor/ylwrap libraries/libapparmor/doc/Makefile.in libraries/libapparmor/doc/*.2 libraries/libapparmor/src/Makefile.in libraries/libapparmor/src/af_protos.h libraries/libapparmor/src/grammar.c libraries/libapparmor/src/grammar.h libraries/libapparmor/src/scanner.c libraries/libapparmor/src/scanner.h libraries/libapparmor/swig/Makefile.in libraries/libapparmor/swig/perl/.build-stamp libraries/libapparmor/swig/perl/LibAppArmor.pm libraries/libapparmor/swig/perl/Makefile.in libraries/libapparmor/swig/perl/Makefile.perl.old libraries/libapparmor/swig/perl/Makefile.perle libraries/libapparmor/swig/perl/libapparmor_wrap.c libraries/libapparmor/swig/python/Makefile.in libraries/libapparmor/swig/ruby/Makefile.in libraries/libapparmor/testsuite/Makefile.in libraries/libapparmor/testsuite/config/Makefile.in libraries/libapparmor/testsuite/lib/Makefile.in libraries/libapparmor/testsuite/libaalogparse.test/Makefile.in debian/apparmor-profiles.postinst0000644000000000000000000000405511773235147014453 0ustar #!/bin/sh # postinst script for apparmor-profiles # # see: dh_installdeb(1) set -e # summary of how this script can be called: # * `configure' # * `abort-upgrade' # * `abort-remove' `in-favour' # # * `abort-remove' # * `abort-deconfigure' `in-favour' # `removing' # # for details, see http://www.debian.org/doc/debian-policy/ or # the debian-policy package # dh_installdeb will replace this with shell code automatically # generated by other debhelper scripts. case "$1" in configure) if [ ! -e /etc/apparmor.d/abstractions/ubuntu-browsers.d/chromium-browser ]; then cp /usr/share/apparmor-profiles/abstractions/ubuntu-browsers.d/chromium-browser /etc/apparmor.d/abstractions/ubuntu-browsers.d || true fi ;; esac #DEBHELPER# # If dh_apparmor did not exist, rebuild the local files manually if [ "$1" = "configure" ]; then for profile in $(dpkg -L apparmor-profiles | egrep '^/etc/apparmor.d/[^/]+$') do APP_PROFILE="$profile" if [ -f "$APP_PROFILE" ]; then # Add the local/ include PROFILE_NAME=$(basename "$profile") LOCAL_APP_PROFILE=/etc/apparmor.d/local/"$PROFILE_NAME" test -e "$LOCAL_APP_PROFILE" || { tmp=`mktemp` cat < "$tmp" # Site-specific additions and overrides for $PROFILE_NAME. # For more details, please see /etc/apparmor.d/local/README. EOM mkdir `dirname $LOCAL_APP_PROFILE` 2>/dev/null || true mv -f "$tmp" "$LOCAL_APP_PROFILE" chmod 644 "$LOCAL_APP_PROFILE" } fi done fi case "$1" in configure) invoke-rc.d apparmor reload || true ;; abort-upgrade|abort-remove|abort-deconfigure) ;; *) echo "postinst called with unknown argument \`$1'" >&2 exit 1 ;; esac exit 0 debian/libapache2-mod-apparmor.install0000644000000000000000000000024111773235147015153 0ustar debian/etc/apache2/* /etc/apache2/ usr/lib/apache2/* etc/apparmor.d/usr.lib.apache2.mpm-prefork.apache2 etc/apparmor.d/local/usr.lib.apache2.mpm-prefork.apache2 debian/aa-update-browser.80000644000000000000000000000262011773235147012613 0ustar .IX Title "AA-UPDATE-BROWSER 8" .TH AA-UPDATE-BROWSER 8 "2010-08-11" "Canonical Ltd" "AppArmor" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l .nh .SH "NAME" aa-update-browser \- update browser profiles with browser abstractions .SH "SYNOPSIS" .IX Header "SYNOPSIS" \&\fBaa-update-browser\fR [option] .SH "DESCRIPTION" .IX Header "DESCRIPTION" \&\fBaa-update-browser\fR will list current browser abstractions in /etc/apparmor.d/abstractions/ubuntu-browsers.d as well as update browser profiles to use those abstractions. .SH "OPTIONS" .IX Header "OPTIONS" \&\fBaa-update-browser\fR accepts the following arguments: .IP "\-d" 4 .IX Item "-d" dry-run. Only show what would be done. .IP "\-u \s-1ABSTRACTIONS\s0" 4 .IX Item "-u ABSTRACTIONS" update the specified profile with the comma-separated list of \s-1ABSTRACTIONS\s0. Specifying '' will remove all \s-1ABSTRACTIONS\s0. .IP "\-l" 4 .IX Item "-l" show supported browser abstractions .IP "\-h" 4 .IX Item "-h" show help .SH "BUGS" .IX Header "BUGS" \&\fBaa-update-browser\fR will always add the plugins-common abstraction if the list of abstractions \s-1ABSTRACTIONS\s0 is not empty. .PP If you find any additional bugs, please report them to Launchpad at . .SH "SEE ALSO" .IX Header "SEE ALSO" \&\fIapparmor\fR\|(7) debian/rules0000755000000000000000000001323211773256146010263 0ustar #!/usr/bin/make -f # -*- makefile -*- # Sample debian/rules that uses debhelper. # This file was originally written by Joey Hess and Craig Small. # As a special exception, when this file is copied by dh-make into a # dh-make output file, you may use that output file without restriction. # This special exception was added by Craig Small in version 0.37 of dh-make. # Uncomment this to turn on verbose mode. #export DH_VERBOSE=1 # Uncomment to turn on verbose build-time test output #export VERBOSE=1 DPKG_EXPORT_BUILDFLAGS = 1 include /usr/share/dpkg/buildflags.mk # libapparmor uses autotools export DEB_HOST_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE) export DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE) export DEB_HOST_ARCH_OS ?= $(shell dpkg-architecture -qDEB_HOST_ARCH_OS) CONFFLAGS = --prefix=/usr --with-perl --with-python ifeq ($(DEB_BUILD_GNU_TYPE), $(DEB_HOST_GNU_TYPE)) CONFFLAGS += --build $(DEB_HOST_GNU_TYPE) else CONFFLAGS += --build $(DEB_BUILD_GNU_TYPE) --host $(DEB_HOST_GNU_TYPE) endif configure: configure-stamp configure-stamp: dh_testdir cd libraries/libapparmor && \ sh autogen.sh && \ sh configure $(CONFFLAGS) touch configure-stamp build: build-arch build-indep build-arch: build-stamp build-indep: build-stamp build-stamp: configure-stamp dh_testdir cd libraries/libapparmor && $(MAKE) && $(MAKE) check cd utils && $(MAKE) ifneq (,$(filter $(DEB_HOST_ARCH_OS), kfreebsd knetbsd hurd )) cd parser && $(MAKE) indep else cd parser && $(MAKE) && $(MAKE) check endif cd profiles && $(MAKE) touch $@ clean: dh_testdir dh_testroot rm -f build-stamp configure-stamp for i in utils parser profiles changehat/mod_apparmor \ changehat/pam_apparmor ; do \ [ ! -f $$i/Makefile ] || $(MAKE) -C $$i clean; \ rm -f $$i/common; \ done # Try to clean up from an autogen'd build cd libraries/libapparmor && [ ! -f Makefile ] || $(MAKE) distclean # Remove generated debhelper documentation. rm -f $(CURDIR)/debian/debhelper/dh_apparmor.1 dh_clean install: build dh_testdir dh_testroot dh_prep dh_installdirs # Utils cd utils; $(MAKE) \ DESTDIR=$(CURDIR)/debian/tmp \ PERLDIR=$(CURDIR)/debian/tmp/usr/share/perl5/Immunix \ install # Parser ifneq (,$(filter $(DEB_HOST_ARCH_OS), kfreebsd knetbsd hurd )) install -D -m 755 $(CURDIR)/debian/non-linux/apparmor_parser \ $(CURDIR)/debian/tmp/sbin/apparmor_parser cd parser; $(MAKE) \ DESTDIR=$(CURDIR)/debian/tmp \ install-indep else cd parser; $(MAKE) \ DESTDIR=$(CURDIR)/debian/tmp \ install endif # Changehat via libapparmor cd libraries/libapparmor; $(MAKE) \ DESTDIR=$(CURDIR)/debian/tmp \ install # fixup rpath for libapparmor-perl find $(CURDIR)/debian/tmp/usr/lib/perl5 -name '*.so' | xargs chrpath --delete # Changehat via mod_apparmor cd changehat/mod_apparmor; $(MAKE) \ DESTDIR=$(CURDIR)/debian/tmp \ install # Fix rpath in mod_apparmor.so chrpath -d $(CURDIR)/debian/tmp/usr/lib/apache2/modules/mod_apparmor.so # Changehat via libpam-apparmor cd changehat/pam_apparmor; $(MAKE) \ DESTDIR=$(CURDIR)/debian/tmp \ install # Fix rpath in pam_apparmor.so chrpath -d $(CURDIR)/debian/tmp/lib/security/pam_apparmor.so # Profiles cd profiles; $(MAKE) \ DESTDIR=$(CURDIR)/debian/tmp \ EXTRAS_DEST=$(CURDIR)/debian/tmp/usr/share/doc/apparmor-profiles/extras \ install # set all profiles in apparmor-profiles to complain mode cd $(CURDIR)/debian/tmp && sh $(CURDIR)/debian/put-all-profiles-in-complain-mode.sh # Build debhelper documentation. pod2man -c Debhelper -r "$(DEB_VERSION)" $(CURDIR)/debian/debhelper/dh_apparmor $(CURDIR)/debian/debhelper/dh_apparmor.1 dh_install # Must not depend on anything. This is to be called by # binary-arch/binary-indep # in another 'make' thread. binary-common: dh_testdir dh_testroot dh_installchangelogs dh_installdocs dh_installexamples # dh_installmenu dh_installdebconf -papparmor # dh_installlogrotate # dh_installemacsen # dh_installpam # dh_installmime dh_installinit --update-rcd-params='start 37 S .' --no-restart-on-upgrade --error-handler=true # dh_installcron # dh_installinfo dh_installman dh_lintian dh_link dh_strip dh_compress -Xextras dh_fixperms dh_perl dh_python2 -p python-libapparmor -p apparmor -p apparmor-utils --no-guessing-versions dh_makeshlibs dh_installdeb dh_shlibdeps dh_gencontrol dh_md5sums dh_builddeb # Build architecture independant packages using the common target. binary-indep: build install for profile in $(shell grep ^etc/apparmor.d/ $(CURDIR)/debian/apparmor-profiles.install | \ cut -d/ -f3- | grep -v /); do \ if [ -x /usr/bin/dh_apparmor ]; then \ dh_apparmor --profile-name=$$profile -papparmor-profiles; \ fi; \ done $(MAKE) -f debian/rules DH_OPTIONS=-i binary-common # Build architecture dependant packages using the common target. binary-arch: build install $(MAKE) -f debian/rules DH_OPTIONS=-s binary-common binary: binary-arch binary-indep .PHONY: build clean binary-indep binary-arch binary install configure VERSION_SEP=+ VERSION=$(shell dpkg-parsechangelog | grep ^Version | cut -d$(VERSION_SEP) -f1 | cut -d\ -f2) BZR_RELEASE=$(shell dpkg-parsechangelog | grep ^Version | cut -d$(VERSION_SEP) -f2 | cut -d. -f1 | cut -d- -f1 | sed -e 's/bzr//') ORIG_FILE=$(CURDIR)/../apparmor_$(VERSION)$(VERSION_SEP)bzr$(BZR_RELEASE).orig.tar.gz BZR_CO_DIR=$(CURDIR)/apparmor-$(VERSION)$(VERSION_SEP)bzr$(BZR_RELEASE) get-orig-source: test ! -e $(ORIG_FILE) test ! -e $(BZR_CO_DIR) bzr checkout --lightweight -r $(BZR_RELEASE) lp:~apparmor-dev/apparmor/master $(BZR_CO_DIR) tar czf $(ORIG_FILE) -C `dirname $(BZR_CO_DIR)` --exclude .bzr `basename $(BZR_CO_DIR)` rm -rf $(BZR_CO_DIR) debian/control0000644000000000000000000001227212035207742010577 0ustar Source: apparmor Section: admin Priority: extra Maintainer: Kees Cook Build-Depends: debhelper (>= 9.20120322~), po-debconf, dpkg-dev (>= 1.16.1~), autotools-dev, libtool, automake, autoconf, chrpath, flex, bison, dejagnu, swig, bzip2, apache2-prefork-dev, libpam-dev, texlive-latex-base, texlive-latex-recommended, python-all-dev, python, perl (>= 5.8.0), liblocale-gettext-perl, gcc-4.7 Standards-Version: 3.9.3 Homepage: http://apparmor.net/ Vcs-Bzr: https://code.launchpad.net/~kees/apparmor/debian Package: apparmor Architecture: any Pre-Depends: ${misc:Pre-Depends} Depends: ${shlibs:Depends}, ${misc:Depends}, ${python:Depends}, lsb-base, initramfs-tools [linux-any], debconf Breaks: libapache2-mod-apparmor (<< 2.5.1-0ubuntu3), apparmor-utils (<< 2.6.1-4ubuntu1) Replaces: apparmor-parser, libapache2-mod-apparmor (<< 2.5.1-0ubuntu3), apparmor-utils (<< 2.6.1-4ubuntu1) Suggests: apparmor-profiles, apparmor-docs, apparmor-utils Description: User-space parser utility for AppArmor This provides the system initialization scripts needed to use the AppArmor Mandatory Access Control system, including the AppArmor Parser which is required to convert AppArmor text profiles into machine-readable policies that are loaded into the kernel for use with the AppArmor Linux Security Module. Package: apparmor-utils Architecture: any Depends: apparmor (>= 2.6.1-4ubuntu1), liblocale-gettext-perl, libterm-readkey-perl, librpc-xml-perl, libapparmor-perl, ${shlibs:Depends}, ${misc:Depends}, ${perl:Depends}, ${python:Depends} Suggests: apparmor-docs, libterm-readline-gnu-perl, vim-addon-manager Description: Utilities for controlling AppArmor This provides the utilities to operate on AppArmor profiles, as well as the Perl modules needed for AppArmor audit log parsing. Profiles can be created, updated, enforced, set to complain mode, and disabled. Package: apparmor-profiles Architecture: all Depends: ${misc:Depends}, apparmor Description: Profiles for AppArmor Security policies This provides various AppArmor profiles that have not been shipped by the packages they provide confinement for. By default, they ship in complain mode so that users can test and choose which are desired. Package: apparmor-docs Section: doc Architecture: all Depends: ${misc:Depends} Description: Documentation for AppArmor Thie provides some technical documentation for the AppArmor Mandatory Access Control system. Currently this is only a single PDF covering basic operation, written some time ago. Package: libapparmor-dev Section: libdevel Architecture: any Depends: libapparmor1 (= ${binary:Version}), ${misc:Depends} Description: AppArmor development libraries and header files This package provides the develpment libraries and header files needed to link against the AppArmor changehat and log parsing functions. Also includes the manpages for library functions. Package: libapparmor1 Section: libs Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends} Description: changehat AppArmor library This package provides the shared library used for making use of the AppArmor profile and changehat functionality, as well as common log parsing routines. Package: libapparmor-perl Section: perl Architecture: any Depends: ${perl:Depends}, ${shlibs:Depends}, ${misc:Depends} Description: AppArmor library Perl bindings This provides the Perl module that contains the language bindings for the AppArmor library, libapparmor, which were autogenerated via SWIG. Package: libapache2-mod-apparmor Section: libs Architecture: any Depends: apache2.2-common, ${shlibs:Depends}, ${misc:Depends} Description: changehat AppArmor library as an Apache module This provides the Apache module needed to declare various differing confinement policies when running virtual hosts in the webserver by using the changehat abilities exposed through libapparmor. Package: libpam-apparmor Section: libs Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends} Description: changehat AppArmor library as a PAM module This provides the PAM module needed to declare various differing confinement policies when starting PAM sessions by using the changehat abilities exposed through libapparmor. Package: apparmor-notify Architecture: all Depends: libapparmor-perl, libnotify-bin, ${perl:Depends}, ${misc:Depends} Description: AppArmor notification system This package provides a utility to display AppArmor denial messages via desktop notifications. The utility can also be used to generate summary reports. Package: python-libapparmor Section: python Architecture: any Depends: ${python:Depends}, ${shlibs:Depends}, ${misc:Depends} Description: AppArmor library Python bindings This provides the Python module that contains the language bindings for the AppArmor library, libapparmor, which were autogenerated via SWIG. Package: dh-apparmor Section: devel Architecture: all Multi-Arch: foreign Depends: ${perl:Depends}, ${misc:Depends} Breaks: debhelper (<< 9.20120115ubuntu3) Replaces: debhelper (<< 9.20120115ubuntu3) Description: AppArmor debhelper routines This provides the debhelper tools used to install and migrate AppArmor profiles. This is normally used from package maintainer scripts during install and removal. debian/apparmor.preinst0000644000000000000000000000056211773235147012432 0ustar #!/bin/sh # preinst script for apparmor # # see: dh_installdeb(1) set -e case "$1" in install|upgrade|abort-upgrade) # Nothing to do ;; *) echo "preinst called with unknown argument \`$1'" >&2 exit 1 ;; esac # dh_installdeb will replace this with shell code automatically # generated by other debhelper scripts. #DEBHELPER# exit 0 debian/watch0000644000000000000000000000015311773235147010230 0ustar version=3 http://launchpad.net/apparmor/+download/ http://launchpad.net/apparmor/.*/AppArmor-(.*)\.tar\.gz debian/dh-apparmor.install0000644000000000000000000000025111773235147013000 0ustar debian/debhelper/dh_apparmor usr/bin debian/debhelper/postinst-apparmor usr/share/debhelper/autoscripts debian/debhelper/postrm-apparmor usr/share/debhelper/autoscripts debian/apparmor-docs.doc-base0000644000000000000000000000036111773235147013346 0ustar Document: apparmor Title: AppArmor Technical Documentation Author: Andreas Gruenbacher and Seth Arnold Abstract: Overview of AppArmor technical details Section: System/Security Format: PDF Files: /usr/share/doc/apparmor-docs/techdoc.pdf.gz debian/patches/0000755000000000000000000000000012001061347010607 5ustar debian/patches/abstractions-ubuntu-browsers.patch0000644000000000000000000000173711773235147017540 0ustar Description: include IceWeasel in FireFox abstraction. (Upstream r2036) Author: Intrigeri Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=661176 Index: apparmor-debian/profiles/apparmor.d/abstractions/ubuntu-browsers =================================================================== --- apparmor-debian.orig/profiles/apparmor.d/abstractions/ubuntu-browsers 2012-04-24 11:03:46.506994000 -0700 +++ apparmor-debian/profiles/apparmor.d/abstractions/ubuntu-browsers 2012-04-24 13:01:22.499517948 -0700 @@ -29,8 +29,8 @@ # this should cover all firefox browsers and versions (including shiretoko # and abrowser) - /usr/bin/firefox Cxr -> sanitized_helper, - /usr/lib/firefox*/firefox*.sh Cx -> sanitized_helper, + /usr/bin/{firefox,iceweasel} Cxr -> sanitized_helper, + /usr/lib/{firefox*,iceweasel}/{firefox*.sh,iceweasel} Cx -> sanitized_helper, # some unpackaged, but popular browsers /usr/lib/icecat-*/icecat Cx -> sanitized_helper, debian/patches/aa-status-smarter.patch0000644000000000000000000000527411773235147015235 0ustar Description: Handle lacking the interface patch, and examine the "enabled" parameter for determining the state of AppArmor on the system. Author: Kees Cook Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=661153 Index: apparmor-debian/utils/aa-status =================================================================== --- apparmor-debian.orig/utils/aa-status 2011-05-27 12:08:50.000000000 -0700 +++ apparmor-debian/utils/aa-status 2012-04-24 12:42:39.540597212 -0700 @@ -14,8 +14,7 @@ def cmd_enabled(): '''Returns error code if AppArmor is not enabled''' - if get_profiles() == {}: - sys.exit(2) + find_apparmorfs() def cmd_profiled(): '''Prints the number of loaded profiles''' @@ -72,19 +71,15 @@ '''Fetch loaded profiles''' profiles = {} - - if os.path.exists("/sys/module/apparmor"): - stdmsg("apparmor module is loaded.") - else: - errormsg("apparmor module is not loaded.") - sys.exit(1) - apparmorfs = find_apparmorfs() - if not apparmorfs: - errormsg("apparmor filesystem is not mounted.") - sys.exit(3) + # Kernel with the stock kernel cannot read profiles, but shouldn't + # be considered a fatal failure mode. apparmor_profiles = os.path.join(apparmorfs, "profiles") + if not os.path.exists(apparmor_profiles): + errormsg("AppArmor running without interface patch -- cannot determine loaded profiles.") + return profiles + if not os.access(apparmor_profiles, os.R_OK): errormsg("You do not have enough privilege to read the profile set.") sys.exit(4) @@ -134,11 +129,29 @@ def find_apparmorfs(): '''Finds AppArmor mount point''' + + apparmor_module = "/sys/module/apparmor" + if os.path.exists(apparmor_module): + stdmsg("AppArmor available in kernel.") + else: + errormsg("AppArmor not available in kernel.") + sys.exit(1) + + apparmor_enabled = os.path.join(apparmor_module, "parameters", "enabled") + if not os.access(apparmor_enabled, os.R_OK): + errormsg("You do not have enough privilege to check AppArmor parameters.") + sys.exit(2) + if open(apparmor_enabled, "r").readline().strip() != "Y": + errormsg("AppArmor not enabled. (Kernel not booted with \"security=apparmor\"?)") + sys.exit(3) + for p in open("/proc/mounts").readlines(): if p.split()[2] == "securityfs" and \ os.path.exists(os.path.join(p.split()[1], "apparmor")): return os.path.join(p.split()[1], "apparmor") - return False + + errormsg("AppArmor securityfs not mounted.") + sys.exit(3) def errormsg(message): '''Prints to stderr if verbose mode is on''' debian/patches/non-linux.patch0000644000000000000000000000133411773243733013600 0ustar Description: allow parser to build even when not on Linux. Author: Kees Cook Index: apparmor-debian/common/Make.rules =================================================================== --- apparmor-debian.orig/common/Make.rules 2012-05-05 14:41:25.967259523 -0700 +++ apparmor-debian/common/Make.rules 2012-05-05 14:41:28.451291053 -0700 @@ -160,7 +160,7 @@ CAPABILITIES=$(shell echo "\#include " | cpp -dM | LC_ALL=C sed -n -e '/CAP_EMPTY_SET/d' -e 's/^\#define[ \t]\+CAP_\([A-Z0-9_]\+\)[ \t]\+\([0-9xa-f]\+\)\(.*\)$$/CAP_\1/p' | sort) .PHONY: list_capabilities -list_capabilities: /usr/include/linux/capability.h +list_capabilities: @echo "$(CAPABILITIES)" # ===================== debian/patches/abstractions-X.patch0000644000000000000000000000142411773235147014552 0ustar Description: add gdm3 path to X abstraction. (Upstream r2035) Author: Intrigeri Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660079 Index: apparmor-debian/profiles/apparmor.d/abstractions/X =================================================================== --- apparmor-debian.orig/profiles/apparmor.d/abstractions/X 2012-04-24 11:03:46.506994000 -0700 +++ apparmor-debian/profiles/apparmor.d/abstractions/X 2012-04-24 12:56:42.255783258 -0700 @@ -17,7 +17,7 @@ # .Xauthority files required for X connections, per user @{HOME}/.Xauthority r, - owner /{,var/}run/gdm/*/database r, + owner /{,var/}run/gdm{,3}/*/database r, owner /{,var/}run/lightdm/authority/[0-9]* r, # the unix socket to use to connect to the display debian/patches/0004-lp941808.patch0000644000000000000000000000137611773235147013351 0ustar Author: Jamie Strandboge Description: allow writes to /{,var/}run/sendsigs.omit.d/*dnsmasq.pid for network manager integration Bug-Ubuntu: https://launchpad.net/bugs/941808 Index: apparmor-2.7.99/profiles/apparmor.d/usr.sbin.dnsmasq =================================================================== --- apparmor-2.7.99.orig/profiles/apparmor.d/usr.sbin.dnsmasq 2012-03-02 08:13:38.000000000 -0600 +++ apparmor-2.7.99/profiles/apparmor.d/usr.sbin.dnsmasq 2012-03-02 09:53:59.000000000 -0600 @@ -53,6 +53,7 @@ # NetworkManager integration /{,var/}run/nm-dns-dnsmasq.conf r, + /{,var/}run/sendsigs.omit.d/*dnsmasq.pid w, # Site-specific additions and overrides. See local/README for details. #include debian/patches/pass-compiler-flags.patch0000644000000000000000000000745111773252645015531 0ustar Description: pass CPPFLAGS into build. (Upstream r2037) Author: Kees Cook Index: apparmor-debian/libraries/libapparmor/src/Makefile.am =================================================================== --- apparmor-debian.orig/libraries/libapparmor/src/Makefile.am 2012-06-29 00:04:24.308135919 -0700 +++ apparmor-debian/libraries/libapparmor/src/Makefile.am 2012-06-29 00:04:27.000000000 -0700 @@ -3,7 +3,8 @@ BUILT_SOURCES = grammar.h scanner.h af_protos.h AM_LFLAGS = -v AM_YFLAGS = -d -p aalogparse_ -AM_CFLAGS = @CFLAGS@ -D_GNU_SOURCE -Wall +AM_CFLAGS = -Wall +AM_CPPFLAGS = -D_GNU_SOURCE scanner.h: scanner.l $(LEX) -v $< Index: apparmor-debian/libraries/libapparmor/swig/perl/Makefile.PL.in =================================================================== --- apparmor-debian.orig/libraries/libapparmor/swig/perl/Makefile.PL.in 2012-06-29 00:04:24.296135745 -0700 +++ apparmor-debian/libraries/libapparmor/swig/perl/Makefile.PL.in 2012-06-29 00:13:38.452136217 -0700 @@ -10,8 +10,9 @@ 'FIRST_MAKEFILE' => 'Makefile.perl', 'ABSTRACT' => q[Perl interface to AppArmor] , 'VERSION' => q[@VERSION@], - 'INC' => q[-I@top_srcdir@/src @CFLAGS@], + 'INC' => q[@CPPFLAGS@ -I@top_srcdir@/src @CFLAGS@], 'LIBS' => q[-L@top_builddir@/src/.libs/ -lapparmor @LIBS@], 'OBJECT' => 'libapparmor_wrap.o', # $(OBJ_EXT) + 'dynamic_lib' => { 'OTHERLDFLAGS' => q[@LDFLAGS@], }, ) ; Index: apparmor-debian/libraries/libapparmor/m4/ac_python_devel.m4 =================================================================== --- apparmor-debian.orig/libraries/libapparmor/m4/ac_python_devel.m4 2012-06-29 00:04:24.276135455 -0700 +++ apparmor-debian/libraries/libapparmor/m4/ac_python_devel.m4 2012-06-29 00:04:27.000000000 -0700 @@ -158,6 +158,8 @@ AC_MSG_CHECKING([consistency of all components of python development environment]) AC_LANG_PUSH([C]) # save current global flags + ac_save_LIBS="$LIBS" + ac_save_CPPFLAGS="$CPPFLAGS" LIBS="$ac_save_LIBS $PYTHON_LDFLAGS" CPPFLAGS="$ac_save_CPPFLAGS $PYTHON_CPPFLAGS" AC_TRY_LINK([ Index: apparmor-debian/libraries/libapparmor/testsuite/Makefile.am =================================================================== --- apparmor-debian.orig/libraries/libapparmor/testsuite/Makefile.am 2012-06-29 00:04:24.288135629 -0700 +++ apparmor-debian/libraries/libapparmor/testsuite/Makefile.am 2012-06-29 00:04:27.000000000 -0700 @@ -10,8 +10,7 @@ noinst_PROGRAMS = test_multi.multi test_multi_multi_SOURCES = test_multi.c -test_multi_multi_CFLAGS = $(CFLAGS) -Wall -test_multi_multi_LDFLAGS = $(LDFLAGS) +test_multi_multi_CFLAGS = -Wall test_multi_multi_LDADD = -L../src/.libs -lapparmor clean-local: Index: apparmor-debian/changehat/pam_apparmor/Makefile =================================================================== --- apparmor-debian.orig/changehat/pam_apparmor/Makefile 2012-06-29 00:04:24.320136093 -0700 +++ apparmor-debian/changehat/pam_apparmor/Makefile 2012-06-29 00:04:27.000000000 -0700 @@ -27,7 +27,7 @@ endif EXTRA_CFLAGS=$(CFLAGS) -fPIC -shared -Wall -I../../libraries/libapparmor/src/ -LINK_FLAGS=-Xlinker -x -L../../libraries/libapparmor/src/.libs +LINK_FLAGS=-Xlinker -x -L../../libraries/libapparmor/src/.libs $(LDFLAGS) LIBS=-lpam -lapparmor OBJECTS=${NAME}.o get_options.o Index: apparmor-debian/parser/Makefile =================================================================== --- apparmor-debian.orig/parser/Makefile 2012-06-29 00:04:24.332136265 -0700 +++ apparmor-debian/parser/Makefile 2012-06-29 00:04:27.000000000 -0700 @@ -85,7 +85,7 @@ AAREDIR= libapparmor_re AAREOBJECT = ${AAREDIR}/libapparmor_re.a AAREOBJECTS = $(AAREOBJECT) libstdc++.a -AARE_LDFLAGS=-static-libgcc -L. +AARE_LDFLAGS=-static-libgcc -L. $(LDFLAGS) LEX_C_FILES = parser_lex.c YACC_C_FILES = parser_yacc.c parser_yacc.h debian/patches/notify-group.patch0000644000000000000000000000107311773235147014313 0ustar Description: The group for reading /var/log/kern.log is "adm", not "admin". Author: Kees Cook Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660078 Index: apparmor-debian/utils/notify.conf =================================================================== --- apparmor-debian.orig/utils/notify.conf 2010-11-03 17:03:52.000000000 -0700 +++ apparmor-debian/utils/notify.conf 2012-04-24 11:54:27.997521983 -0700 @@ -12,4 +12,4 @@ show_notifications="yes" # Only people in use_group can use aa-notify -use_group="admin" +use_group="adm" debian/patches/fix-network-rule-support.patch0000644000000000000000000000127712001061347016573 0ustar Description: handle missing network mediation support. Author: John Johansen Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=679597 Index: apparmor-debian/parser/parser_main.c =================================================================== --- apparmor-debian.orig/parser/parser_main.c 2012-06-28 22:17:27.433492000 -0700 +++ apparmor-debian/parser/parser_main.c 2012-07-16 11:51:23.742020178 -0700 @@ -1182,7 +1182,10 @@ write_cache = 0; skip_read_cache = 1; return; - } + } else if (strstr(flags_string, "network")) + kernel_supports_network = 1; + else + kernel_supports_network = 0; /* * Deal with cache directory versioning: debian/patches/0007-ubuntu-manpage-updates.patch0000644000000000000000000000661011773235147016632 0ustar Author: Jamie Strandboge Description: Adjust apparmor(5) to describe policy load on Ubuntu Bug-Ubuntu: https://launchpad.net/bugs/974089 Forward: no (Ubuntu specific) Index: apparmor-ubuntu-trunk/parser/apparmor.pod =================================================================== --- apparmor-ubuntu-trunk.orig/parser/apparmor.pod 2010-12-20 14:29:10.000000000 -0600 +++ apparmor-ubuntu-trunk/parser/apparmor.pod 2012-04-05 10:19:29.000000000 -0500 @@ -3,7 +3,7 @@ # 2008, 2009 # NOVELL (All rights reserved) # -# Copyright (c) 2010 +# Copyright (c) 2010, 2011, 2012 # Canonical Ltd. (All rights reserved) # # This program is free software; you can redistribute it and/or @@ -16,7 +16,7 @@ # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License -# along with this program; if not, contact Novell, Inc. +# along with this program; if not, contact Canonical Ltd. # ---------------------------------------------------------------------- @@ -34,7 +34,8 @@ AppArmor confinement is provided via I loaded into the kernel via apparmor_parser(8), typically through the F -SysV initscript, which is used like this: +SysV initscript (on Ubuntu, also see UBUNTU POLICY LOAD, below), which is used +like this: # /etc/init.d/apparmor start # /etc/init.d/apparmor stop @@ -94,6 +95,41 @@ A confined process can not call mknod(2) to create character or block devices. +=head1 UBUNTU POLICY LOAD + +Ubuntu systems use Upstart instead of a traditional SysV init system. Because +Upstart is an event-driven init system and understanding that policy must be +loaded before execution, Ubuntu loads policy in two stages: first via upstart +jobs for binaries that are started in early boot, and then via a SysV +initscript that starts in S37 for all remaining policy. When developing +policy it is important to know how your application is started and if policy +load should be handled specially. + +In general, nothing extra has to be done for applications without an initscript +or with an initscript that starts after AppArmor's second stage initscript. + +If the confined application has an Upstart job, adjust the job to call +F with the filename of the policy file +(relative to F). For example: + + pre-start script + /lib/init/apparmor-profile-load usr.bin.foo + end script + +If the confined application does not have an Upstart job but it starts before +AppArmor's second stage initscript, then add a symlink from the policy file in +F to F. For +example: + + # cd /etc/apparmor/init/network-interface-security/ + # ln -s /etc/apparmor.d/usr.bin.foo . + +The network-interface-security Upstart job will load all the symlinked policy +files in F before any network +interfaces come up. Because network interfaces come up very early in the boot +process, this will help ensure that AppArmor policy is loaded before the +confined application starts. + =head1 ERRORS When a confined process tries to access a file it does not have permission @@ -140,6 +176,8 @@ =item F +=item F + =item F =item F debian/patches/0003-add-aa-easyprof.patch0000644000000000000000000021650111773235147015172 0ustar Author: Jamie Strandboge Description: Template-based profile generator providing both a standalone CLI application and library which can also be imported into developer SDKs. https://wiki.ubuntu.com/SecurityTeam/Specifications/Precise/AppArmorEasyprof Forwarded: yes Index: apparmor-debian/utils/aa-easyprof =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-debian/utils/aa-easyprof 2012-04-24 11:27:49.780061274 -0700 @@ -0,0 +1,65 @@ +#! /usr/bin/env python +# ------------------------------------------------------------------ +# +# Copyright (C) 2011-2012 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +import apparmor.easyprof +from apparmor.easyprof import AppArmorException, error +import os +import sys + +if __name__ == "__main__": + def usage(): + '''Return usage information''' + return 'USAGE: %s [options] ' % \ + os.path.basename(sys.argv[0]) + + (opt, args) = apparmor.easyprof.parse_args() + binary = None + + m = usage() + if opt.show_policy_group and not opt.policy_groups: + error("Must specify -p with --show-policy-group") + elif not opt.template and not opt.policy_groups and len(args) < 1: + error("Must specify full path to binary\n%s" % m) + + binary = None + if len(args) >= 1: + binary = args[0] + + try: + easyp = apparmor.easyprof.AppArmorEasyProfile(binary, opt) + except AppArmorException, e: + error(e.value) + except Exception: + raise + + if opt.list_templates: + apparmor.easyprof.print_basefilenames(easyp.get_templates()) + sys.exit(0) + elif opt.template and opt.show_template: + files = [os.path.join(easyp.dirs['templates'], opt.template)] + apparmor.easyprof.print_files(files) + sys.exit(0) + elif opt.list_policy_groups: + apparmor.easyprof.print_basefilenames(easyp.get_policy_groups()) + sys.exit(0) + elif opt.policy_groups and opt.show_policy_group: + for g in opt.policy_groups.split(','): + files = [os.path.join(easyp.dirs['policygroups'], g)] + apparmor.easyprof.print_files(files) + sys.exit(0) + elif binary == None: + error("Must specify full path to binary\n%s" % m) + + # if we made it here, generate a profile + params = apparmor.easyprof.gen_policy_params(binary, opt) + p = easyp.gen_policy(**params) + print p, + Index: apparmor-debian/utils/aa-easyprof.pod =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-debian/utils/aa-easyprof.pod 2012-04-24 11:27:49.788061383 -0700 @@ -0,0 +1,146 @@ +# This publication is intellectual property of Canonical Ltd. Its contents +# can be duplicated, either in part or in whole, provided that a copyright +# label is visibly located on each copy. +# +# All information found in this book has been compiled with utmost +# attention to detail. However, this does not guarantee complete accuracy. +# Neither Canonical Ltd, the authors, nor the translators shall be held +# liable for possible errors or the consequences thereof. +# +# Many of the software and hardware descriptions cited in this book +# are registered trademarks. All trade names are subject to copyright +# restrictions and may be registered trade marks. Canonical Ltd +# essentially adheres to the manufacturer's spelling. +# +# Names of products and trademarks appearing in this book (with or without +# specific notation) are likewise subject to trademark and trade protection +# laws and may thus fall under copyright restrictions. +# + +=pod + +=head1 NAME + +aa-easyprof - AppArmor profile generation made easy. + +=head1 SYNOPSIS + +B [option] + +=head1 DESCRIPTION + +B provides an easy to use interface for AppArmor policy +generation. B supports the use of templates and policy groups to +quickly profile an application. Please note that while this tool can help +with policy generation, its utility is dependent on the quality of the +templates, policy groups and abstractions used. Also, this tool may create +policy which is less restricted than creating policy by hand or with +B and B. + +=head1 OPTIONS + +B accepts the following arguments: + +=over 4 + +=item -t TEMPLATE, --template=TEMPLATE + +Specify which template to use. May specify either a system template from +/usr/share/apparmor/easyprof/templates or a filename for the template to +use. If not specified, use /usr/share/apparmor/easyprof/templates/default. + +=item -p POLICYGROUPS, --policy-groups=POLICYGROUPS + +Specify POLICY as a comma-separated list of policy groups. See --list-templates +for supported policy groups. The available policy groups are in +/usr/share/apparmor/easyprof/policy. Policy groups are simply groupings of +AppArmor rules or policies. They are similar to AppArmor abstractions, but +usually encompass more policy rules. + +=item -a ABSTRACTIONS, --abstractions=ABSTRACTIONS + +Specify ABSTRACTIONS as a comma-separated list of AppArmor abstractions. It is +usually recommended you use policy groups instead, but this is provided as a +convenience. AppArmor abstractions are located in /etc/apparmor.d/abstractions. +See apparmor.d(5) for details. + +=item -r PATH, --read-path=PATH + +Specify a PATH to allow owner reads. May be specified multiple times. If the +PATH ends in a '/', then PATH is treated as a directory and reads are allowed +to all files under this directory. Can optionally use '/*' at the end of the +PATH to only allow reads to files directly in PATH. + +=item -w PATH, --write-dir=PATH + +Like --read-path but also allow owner writes in additions to reads. + +=item -n NAME, --name=NAME + +Specify NAME of policy. If not specified, NAME is set to the name of the +binary. The NAME of the policy is often used as part of the path in the +various templates. + +=item --template-var="@{VAR}=VALUE" + +Set VAR to VALUE in the resulting policy. This typically only makes sense if +the specified template uses this value. May be specified multiple times. + +=item --list-templates + +List available templates. + +=item --show-template=TEMPLATE + +Display template specified with --template. + +=item --templates-dir=PATH + +Use PATH instead of system templates directory. + +=item --list-policy-groups + +List available policy groups. + +=item --show-policy-group + +Display policy groups specified with --policy. + +=item --policy-groups-dir=PATH + +Use PATH instead of system policy-groups directory. + +=item --author + +Specify author of the policy. + +=item --copyright + +Specify copyright of the policy. + +=item --comment + +Specify comment for the policy. + +=back + +=head1 EXAMPLE + +Example usage for a program named 'foo' which is installed in /opt/foo: + +=over + +$ aa-easyprof --template=user-application --template-var="@{APPNAME}=foo" --policy-groups=opt-application,user-application /opt/foo/bin/FooApp + +=back + +=head1 BUGS + +If you find any additional bugs, please report them to Launchpad at +L. + +=head1 SEE ALSO + +apparmor(7) apparmor.d(5) + +=cut Index: apparmor-debian/utils/apparmor/easyprof.py =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-debian/utils/apparmor/easyprof.py 2012-04-24 11:27:49.792061437 -0700 @@ -0,0 +1,567 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2011-2012 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +import codecs +import glob +import optparse +import os +import re +import subprocess +import sys +import tempfile + +# +# TODO: move this out to the common library +# +#from apparmor import AppArmorException +class AppArmorException(Exception): + '''This class represents AppArmor exceptions''' + def __init__(self, value): + self.value = value + + def __str__(self): + return repr(self.value) +# +# End common +# + +DEBUGGING = False + +# +# TODO: move this out to a utilities library +# +def error(out, exit_code=1, do_exit=True): + '''Print error message and exit''' + try: + print >> sys.stderr, "ERROR: %s" % (out) + except IOError: + pass + + if do_exit: + sys.exit(exit_code) + + +def warn(out): + '''Print warning message''' + try: + print >> sys.stderr, "WARN: %s" % (out) + except IOError: + pass + + +def msg(out, output=sys.stdout): + '''Print message''' + try: + print >> output, "%s" % (out) + except IOError: + pass + + +def cmd(command): + '''Try to execute the given command.''' + debug(command) + try: + sp = subprocess.Popen(command, stdout=subprocess.PIPE, + stderr=subprocess.STDOUT) + except OSError, ex: + return [127, str(ex)] + + out = sp.communicate()[0] + return [sp.returncode, out] + + +def cmd_pipe(command1, command2): + '''Try to pipe command1 into command2.''' + try: + sp1 = subprocess.Popen(command1, stdout=subprocess.PIPE) + sp2 = subprocess.Popen(command2, stdin=sp1.stdout) + except OSError, ex: + return [127, str(ex)] + + out = sp2.communicate()[0] + return [sp2.returncode, out] + + +def debug(out): + '''Print debug message''' + if DEBUGGING: + try: + print >> sys.stderr, "DEBUG: %s" % (out) + except IOError: + pass + + +def valid_binary_path(path): + '''Validate name''' + try: + a_path = os.path.abspath(path) + except Exception: + debug("Could not find absolute path for binary") + return False + + if path != a_path: + debug("Binary should use a normalized absolute path") + return False + + if not os.path.exists(a_path): + return True + + r_path = os.path.realpath(path) + if r_path != a_path: + debug("Binary should not be a symlink") + return False + + return True + + +def valid_variable_name(var): + '''Validate variable name''' + if re.search(r'[a-zA-Z0-9_]+$', var): + return True + return False + + +def valid_path(path): + '''Valid path''' + # No relative paths + m = "Invalid path: %s" % (path) + if not path.startswith('/'): + debug("%s (relative)" % (m)) + return False + + try: + os.path.normpath(path) + except Exception: + debug("%s (could not normalize)" % (m)) + return False + return True + + +def get_directory_contents(path): + '''Find contents of the given directory''' + if not valid_path(path): + return None + + files = [] + for f in glob.glob(path + "/*"): + files.append(f) + + files.sort() + return files + +def open_file_read(path): + '''Open specified file read-only''' + try: + orig = codecs.open(path, 'r', "UTF-8") + except Exception: + raise + + return orig + + +def verify_policy(policy): + '''Verify policy compiles''' + exe = "/sbin/apparmor_parser" + if not os.path.exists(exe): + rc, exe = cmd(['which', 'apparmor_parser']) + if rc != 0: + warn("Could not find apparmor_parser. Skipping verify") + return True + + fn = "" + # if policy starts with '/' and is one line, assume it is a path + if len(policy.splitlines()) == 1 and valid_path(policy): + fn = policy + else: + f, fn = tempfile.mkstemp(prefix='aa-easyprof') + os.write(f, policy) + os.close(f) + + rc, out = cmd([exe, '-p', fn]) + os.unlink(fn) + if rc == 0: + return True + return False + +# +# End utility functions +# + + +class AppArmorEasyProfile: + '''Easy profile class''' + def __init__(self, binary, opt): + self.conffile = "/etc/apparmor/easyprof.conf" + if opt.conffile: + self.conffile = os.path.abspath(opt.conffile) + + self.dirs = dict() + if os.path.isfile(self.conffile): + self._get_defaults() + + if opt.templates_dir and os.path.isdir(opt.templates_dir): + self.dirs['templates'] = os.path.abspath(opt.templates_dir) + elif not opt.templates_dir and \ + opt.template and \ + os.path.isfile(opt.template) and \ + valid_path(opt.template): + # If we specified the template and it is an absolute path, just set + # the templates directory to the parent of the template so we don't + # have to require --template-dir with absolute paths. + self.dirs['templates'] = os.path.abspath(os.path.dirname(opt.template)) + if opt.policy_groups_dir and os.path.isdir(opt.policy_groups_dir): + self.dirs['policygroups'] = os.path.abspath(opt.policy_groups_dir) + + if not self.dirs.has_key('templates'): + raise AppArmorException("Could not find templates directory") + if not self.dirs.has_key('policygroups'): + raise AppArmorException("Could not find policygroups directory") + + self.aa_topdir = "/etc/apparmor.d" + + self.binary = binary + if binary != None: + if not valid_binary_path(binary): + raise AppArmorException("Invalid path for binary: '%s'" % binary) + + self.set_template(opt.template) + self.set_policygroup(opt.policy_groups) + if opt.name: + self.set_name(opt.name) + elif self.binary != None: + self.set_name(self.binary) + + self.templates = get_directory_contents(self.dirs['templates']) + self.policy_groups = get_directory_contents(self.dirs['policygroups']) + + def _get_defaults(self): + '''Read in defaults from configuration''' + if not os.path.exists(self.conffile): + raise AppArmorException("Could not find '%s'" % self.conffile) + + # Read in the configuration + f = open_file_read(self.conffile) + + pat = re.compile(r'^\w+=".*"?') + for line in f: + if not pat.search(line): + continue + if line.startswith("POLICYGROUPS_DIR="): + d = re.split(r'=', line.strip())[1].strip('["\']') + self.dirs['policygroups'] = d + elif line.startswith("TEMPLATES_DIR="): + d = re.split(r'=', line.strip())[1].strip('["\']') + self.dirs['templates'] = d + f.close() + + keys = self.dirs.keys() + if 'templates' not in keys: + raise AppArmorException("Could not find TEMPLATES_DIR in '%s'" % self.conffile) + if 'policygroups' not in keys: + raise AppArmorException("Could not find POLICYGROUPS_DIR in '%s'" % self.conffile) + + for k in self.dirs.keys(): + if not os.path.isdir(self.dirs[k]): + raise AppArmorException("Could not find '%s'" % self.dirs[k]) + + def set_name(self, name): + '''Set name of policy''' + self.name = name + + def get_template(self): + '''Get contents of current template''' + return open(self.template).read() + + def set_template(self, template): + '''Set current template''' + self.template = template + if not template.startswith('/'): + self.template = os.path.join(self.dirs['templates'], template) + if not os.path.exists(self.template): + raise AppArmorException('%s does not exist' % (self.template)) + + def get_templates(self): + '''Get list of all available templates by filename''' + return self.templates + + def get_policygroup(self, policygroup): + '''Get contents of specific policygroup''' + p = policygroup + if not p.startswith('/'): + p = os.path.join(self.dirs['policygroups'], p) + if self.policy_groups == None or not p in self.policy_groups: + raise AppArmorException("Policy group '%s' does not exist" % p) + return open(p).read() + + def set_policygroup(self, policygroups): + '''Set policygroups''' + self.policy_groups = [] + if policygroups != None: + for p in policygroups.split(','): + if not p.startswith('/'): + p = os.path.join(self.dirs['policygroups'], p) + if not os.path.exists(p): + raise AppArmorException('%s does not exist' % (p)) + self.policy_groups.append(p) + + def get_policy_groups(self): + '''Get list of all policy groups by filename''' + return self.policy_groups + + def gen_abstraction_rule(self, abstraction): + '''Generate an abstraction rule''' + p = os.path.join(self.aa_topdir, "abstractions", abstraction) + if not os.path.exists(p): + raise AppArmorException("%s does not exist" % p) + return "#include " % abstraction + + def gen_variable_declaration(self, dec): + '''Generate a variable declaration''' + if not re.search(r'^@\{[a-zA-Z_]+\}=.+', dec): + raise AppArmorException("Invalid variable declaration '%s'" % dec) + return dec + + def gen_path_rule(self, path, access): + rule = [] + if not path.startswith('/') and not path.startswith('@'): + raise AppArmorException("'%s' should not be relative path" % path) + + owner = "" + if path.startswith('/home/') or path.startswith("@{HOME"): + owner = "owner " + + if path.endswith('/'): + rule.append("%s %s," % (path, access)) + rule.append("%s%s** %s," % (owner, path, access)) + elif path.endswith('/**') or path.endswith('/*'): + rule.append("%s %s," % (os.path.dirname(path), access)) + rule.append("%s%s %s," % (owner, path, access)) + else: + rule.append("%s%s %s," % (owner, path, access)) + + return rule + + + def gen_policy(self, name, binary, template_var=[], abstractions=None, policy_groups=None, read_path=[], write_path=[], author=None, comment=None, copyright=None): + def find_prefix(t, s): + '''Calculate whitespace prefix based on occurrence of s in t''' + pat = re.compile(r'^ *%s' % s) + p = "" + for line in t.splitlines(): + if pat.match(line): + p = " " * (len(line) - len(line.lstrip())) + break + return p + + policy = self.get_template() + if '###ENDUSAGE###' in policy: + found = False + tmp = "" + for line in policy.splitlines(): + if not found: + if line.startswith('###ENDUSAGE###'): + found = True + continue + tmp += line + "\n" + policy = tmp + + # Fill-in profile name and binary + policy = re.sub(r'###NAME###', name, policy) + policy = re.sub(r'###BINARY###', binary, policy) + + # Fill-in various comment fields + if comment != None: + policy = re.sub(r'###COMMENT###', "Comment: %s" % comment, policy) + + if author != None: + policy = re.sub(r'###AUTHOR###', "Author: %s" % author, policy) + + if copyright != None: + policy = re.sub(r'###COPYRIGHT###', "Copyright: %s" % copyright, policy) + + # Fill-in rules and variables with proper indenting + search = '###ABSTRACTIONS###' + prefix = find_prefix(policy, search) + s = "%s# No abstractions specified" % prefix + if abstractions != None: + s = "%s# Specified abstractions" % (prefix) + for i in abstractions.split(','): + s += "\n%s%s" % (prefix, self.gen_abstraction_rule(i)) + policy = re.sub(r' *%s' % search, s, policy) + + search = '###POLICYGROUPS###' + prefix = find_prefix(policy, search) + s = "%s# No policy groups specified" % prefix + if policy_groups != None: + s = "%s# Rules specified via policy groups" % (prefix) + for i in policy_groups.split(','): + for line in self.get_policygroup(i).splitlines(): + s += "\n%s%s" % (prefix, line) + if i != policy_groups.split(',')[-1]: + s += "\n" + policy = re.sub(r' *%s' % search, s, policy) + + search = '###VAR###' + prefix = find_prefix(policy, search) + s = "%s# No template variables specified" % prefix + if len(template_var) > 0: + s = "%s# Specified profile variables" % (prefix) + for i in template_var: + s += "\n%s%s" % (prefix, self.gen_variable_declaration(i)) + policy = re.sub(r' *%s' % search, s, policy) + + search = '###READS###' + prefix = find_prefix(policy, search) + s = "%s# No read paths specified" % prefix + if len(read_path) > 0: + s = "%s# Specified read permissions" % (prefix) + for i in read_path: + for r in self.gen_path_rule(i, 'r'): + s += "\n%s%s" % (prefix, r) + policy = re.sub(r' *%s' % search, s, policy) + + search = '###WRITES###' + prefix = find_prefix(policy, search) + s = "%s# No write paths specified" % prefix + if len(write_path) > 0: + s = "%s# Specified write permissions" % (prefix) + for i in write_path: + for r in self.gen_path_rule(i, 'rwk'): + s += "\n%s%s" % (prefix, r) + policy = re.sub(r' *%s' % search, s, policy) + + if not verify_policy(policy): + debug("\n" + policy) + raise AppArmorException("Invalid policy") + + return policy + +def print_basefilenames(files): + for i in files: + print "%s" % (os.path.basename(i)) + +def print_files(files): + for i in files: + print open(i).read() + +def parse_args(args=None): + '''Parse arguments''' + global DEBUGGING + + parser = optparse.OptionParser() + parser.add_option("-c", "--config-file", + dest="conffile", + help="Use alternate configuration file", + metavar="FILE") + parser.add_option("-d", "--debug", + help="Show debugging output", + action='store_true', + default=False) + parser.add_option("-t", "--template", + dest="template", + help="Use non-default policy template", + metavar="TEMPLATE", + default='default') + parser.add_option("--list-templates", + help="List available templates", + action='store_true', + default=False) + parser.add_option("--templates-dir", + dest="templates_dir", + help="Use non-default templates directory", + metavar="DIR") + parser.add_option("--show-template", + help="Show specified template", + action='store_true', + default=False) + parser.add_option("-p", "--policy-groups", + help="Comma-separated list of policy groups", + metavar="POLICYGROUPS") + parser.add_option("--list-policy-groups", + help="List available policy groups", + action='store_true', + default=False) + parser.add_option("--policy-groups-dir", + dest="policy_groups_dir", + help="Use non-default policy-groups directory", + metavar="DIR") + parser.add_option("--show-policy-group", + help="Show specified policy groups", + action='store_true', + default=False) + parser.add_option("-a", "--abstractions", + dest="abstractions", + help="Comma-separated list of abstractions", + metavar="ABSTRACTIONS") + parser.add_option("--read-path", + dest="read_path", + help="Path allowing owner reads", + metavar="PATH", + action="append") + parser.add_option("--write-path", + dest="write_path", + help="Path allowing owner writes", + metavar="PATH", + action="append") + parser.add_option("-n", "--name", + dest="name", + help="Name of policy", + metavar="NAME") + parser.add_option("--comment", + dest="comment", + help="Comment for policy", + metavar="COMMENT") + parser.add_option("--author", + dest="author", + help="Author of policy", + metavar="COMMENT") + parser.add_option("--copyright", + dest="copyright", + help="Copyright for policy", + metavar="COMMENT") + parser.add_option("--template-var", + dest="template_var", + help="Declare AppArmor variable", + metavar="@{VARIABLE}=VALUE", + action="append") + + (my_opt, my_args) = parser.parse_args(args) + if my_opt.debug: + DEBUGGING = True + return (my_opt, my_args) + +def gen_policy_params(binary, opt): + '''Generate parameters for gen_policy''' + params = dict(binary=binary) + if opt.name: + params['name'] = opt.name + else: + params['name'] = os.path.basename(binary) + if opt.template_var: # What about specified multiple times? + params['template_var'] = opt.template_var + if opt.abstractions: + params['abstractions'] = opt.abstractions + if opt.policy_groups: + params['policy_groups'] = opt.policy_groups + if opt.read_path: + params['read_path'] = opt.read_path + if opt.write_path: + params['write_path'] = opt.write_path + if opt.abstractions: + params['abstractions'] = opt.abstractions + if opt.comment: + params['comment'] = opt.comment + if opt.author: + params['author'] = opt.author + if opt.copyright: + params['copyright'] = opt.copyright + + return params + Index: apparmor-debian/utils/easyprof/easyprof.conf =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-debian/utils/easyprof/easyprof.conf 2012-04-24 11:27:49.792061437 -0700 @@ -0,0 +1,5 @@ +# Location of system policygroups +POLICYGROUPS_DIR="/usr/share/apparmor/easyprof/policygroups" + +# Location of system templates +TEMPLATES_DIR="/usr/share/apparmor/easyprof/templates" Index: apparmor-debian/utils/easyprof/policygroups/networking =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-debian/utils/easyprof/policygroups/networking 2012-04-24 11:27:49.792061437 -0700 @@ -0,0 +1,2 @@ +# Policygroup to allow networking +#include Index: apparmor-debian/utils/easyprof/policygroups/opt-application =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-debian/utils/easyprof/policygroups/opt-application 2012-04-24 11:27:49.792061437 -0700 @@ -0,0 +1,3 @@ +# Policy group for applications installed in /opt +/opt/@{APPNAME}/ r, +/opt/@{APPNAME}/** mrk, Index: apparmor-debian/utils/easyprof/policygroups/user-application =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-debian/utils/easyprof/policygroups/user-application 2012-04-24 11:27:49.792061437 -0700 @@ -0,0 +1,8 @@ +# Policy group allowing various writes to standard directories in @{HOMEDIRS} +#include +owner @{HOMEDIRS}/.cache/@{APPNAME}/ rw, +owner @{HOMEDIRS}/.cache/@{APPNAME}/** rwkl, +owner @{HOMEDIRS}/.config/@{APPNAME}/ rw, +owner @{HOMEDIRS}/.config/@{APPNAME}/** rwkl, +owner @{HOMEDIRS}/.local/share/@{APPNAME}/ rw, +owner @{HOMEDIRS}/.local/share/@{APPNAME}/** rwkl, Index: apparmor-debian/utils/easyprof/README =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-debian/utils/easyprof/README 2012-04-24 11:27:49.792061437 -0700 @@ -0,0 +1,44 @@ +AppArmor Easy Profiler +---------------------- +aa-easyprof is a standalone CLI application which can also be imported into +developer SDKs. See test/test-aa-easyprof.py for an example of how to import +this into your SDK. + + +Templates +--------- +Any number of templates can be used. The user may specify one on the command +line or use a system-wide template from /usr/share/apparmor/easyprof/templates. + +Currently the combination of the user-application and the opt-application and +user-application policygroups should achieve a working policy for Ubuntu's +Application Review Board: +- http://developer.ubuntu.com/publish/my-apps-packages/ + +Eg: +$ aa-easyprof --template=user-application \ + --template-var="@{APPNAME}=foo" \ + --policy-groups=opt-application,user-application \ + /opt/foo/bin/foo + +Testing +------- +Unit tests: +$ ./test/test-aa-easyprof.py + +In source manual testing: +$ ./aa-easyprof --templates-dir=./easyprof/templates \ + --policy-groups-dir=./easyprof/policygroups \ + ... \ + /opt/foo/bin/foo + +Post-install manual testing: +$ make DESTDIR=/tmp/test PERLDIR=/tmp/test/usr/share/perl5/Immunix install +$ cd /tmp/test +$ PYTHONPATH=/tmp/test/usr/local/.../dist-packages ./usr/bin/aa-easyprof \ + --templates-dir=/tmp/test/usr/share/apparmor/easyprof/templates \ + --policy-groups-dir=/tmp/test/usr/share/apparmor/easyprof/policygroups \ + /opt/bin/foo + +(you may also adjust /tmp/test/etc/apparmor/easyprof.conf to avoid specifying +--templates-dir and --policy-groups-dir). Index: apparmor-debian/utils/easyprof/templates/default =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-debian/utils/easyprof/templates/default 2012-04-24 11:27:49.792061437 -0700 @@ -0,0 +1,26 @@ +# +# Example usage: +# $ aa-easyprof --policy-groups=user-application /usr/bin/foo +# +###ENDUSAGE### +# vim:syntax=apparmor +# AppArmor policy for ###NAME### +# ###AUTHOR### +# ###COPYRIGHT### +# ###COMMENT### + +#include + +###VAR### + +###BINARY### { + #include + + ###ABSTRACTIONS### + + ###POLICYGROUPS### + + ###READS### + + ###WRITES### +} Index: apparmor-debian/utils/easyprof/templates/user-application =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-debian/utils/easyprof/templates/user-application 2012-04-24 11:27:49.792061437 -0700 @@ -0,0 +1,29 @@ +# +# Example usage for a program named 'foo' which is installed in /opt/foo +# $ aa-easyprof --template=user-application \ +# --template-var="@{APPNAME}=foo" \ +# --policy-groups=opt-application,user-application \ +# /opt/foo/bin/foo +# +###ENDUSAGE### +# vim:syntax=apparmor +# AppArmor policy for ###NAME### +# ###AUTHOR### +# ###COPYRIGHT### +# ###COMMENT### + +#include + +###VAR### + +###BINARY### { + #include + + ###ABSTRACTIONS### + + ###POLICYGROUPS### + + ###READS### + + ###WRITES### +} Index: apparmor-debian/utils/Makefile =================================================================== --- apparmor-debian.orig/utils/Makefile 2012-04-24 11:23:59.336947032 -0700 +++ apparmor-debian/utils/Makefile 2012-04-24 11:27:49.796061491 -0700 @@ -32,8 +32,10 @@ TOOLS = ${PERLTOOLS} aa-decode aa-status MODULES = ${MODDIR}/AppArmor.pm ${MODDIR}/Repository.pm \ ${MODDIR}/Config.pm ${MODDIR}/Severity.pm +PYTOOLS = aa-easyprof +PYSETUP = python-tools-setup.py -MANPAGES = ${TOOLS:=.8} logprof.conf.5 +MANPAGES = ${TOOLS:=.8} logprof.conf.5 ${PYTOOLS:=.8} all: ${MANPAGES} ${HTMLMANPAGES} $(MAKE) -C po all @@ -45,9 +47,10 @@ CONFDIR=${DESTDIR}/etc/apparmor VENDOR_PERL=$(shell perl -e 'use Config; print $$Config{"vendorlib"};') PERLDIR=${DESTDIR}${VENDOR_PERL}/${MODDIR} +PYPREFIX=/usr -po/${NAME}.pot: ${TOOLS} - $(MAKE) -C po ${NAME}.pot NAME=${NAME} SOURCES="${TOOLS} ${MODULES}" +po/${NAME}.pot: ${TOOLS} ${PYTOOLS} + $(MAKE) -C po ${NAME}.pot NAME=${NAME} SOURCES="${TOOLS} ${MODULES} ${PYTOOLS}" .PHONY: install install: ${MANPAGES} ${HTMLMANPAGES} @@ -62,6 +65,7 @@ $(MAKE) install_manpages DESTDIR=${DESTDIR} $(MAKE) -C vim install DESTDIR=${DESTDIR} ln -sf aa-status.8 ${DESTDIR}/${MANDIR}/man8/apparmor_status.8 + python ${PYSETUP} install --prefix=${PYPREFIX} --root=${DESTDIR} --version=${VERSION} .PHONY: clean ifndef VERBOSE @@ -72,6 +76,8 @@ rm -f Make.rules $(MAKE) -C po clean $(MAKE) -C vim clean + rm -rf staging/ build/ + rm -f apparmor/*.pyc # ${CAPABILITIES} is defined in common/Make.rules .PHONY: check_severity_db @@ -92,3 +98,13 @@ for i in ${MODULES} ${PERLTOOLS} ; do \ perl -c $$i || exit 1; \ done + tmpfile=$$(mktemp --tmpdir aa-pyflakes-XXXXXX); \ + for i in ${PYTOOLS} apparmor aa-status test/*.py; do \ + echo Checking $$i; \ + pyflakes $$i 2>&1 | grep -v "undefined name '_'" > $$tmpfile; \ + test -s $$tmpfile && cat $$tmpfile && rm -f $$tmpfile && exit 1; \ + done || true; \ + rm -f $$tmpfile + for i in test/* ; do \ + python $$i || exit 1; \ + done Index: apparmor-debian/utils/python-tools-setup.py =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-debian/utils/python-tools-setup.py 2012-04-24 11:27:49.796061491 -0700 @@ -0,0 +1,79 @@ +# ---------------------------------------------------------------------- +# Copyright (c) 2012 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, contact Canonical, Ltd. +# ---------------------------------------------------------------------- +# +# Usage: +# $ python ./python-tools-setup.py install --root=... --version=... +# +# Note: --version=... must be the last argument to this script +# + +from distutils.command.install import install as _install +from distutils.core import setup +import os +import shutil +import sys + +class Install(_install, object): + '''Override distutils to install the files where we want them.''' + def run(self): + # Now byte-compile everything + super(Install, self).run() + + prefix = self.prefix + if self.root != None: + prefix = self.root + + # Install scripts, configuration files and data + scripts = ['/usr/bin/aa-easyprof'] + self.mkpath(prefix + os.path.dirname(scripts[0])) + for s in scripts: + self.copy_file(os.path.basename(s), prefix + s) + + configs = ['easyprof/easyprof.conf'] + self.mkpath(prefix + "/etc/apparmor") + for c in configs: + self.copy_file(c, os.path.join(prefix + "/etc/apparmor", os.path.basename(c))) + + data = ['easyprof/templates', 'easyprof/policygroups'] + self.mkpath(prefix + "/usr/share/apparmor/easyprof") + for d in data: + self.copy_tree(d, os.path.join(prefix + "/usr/share/apparmor/easyprof", os.path.basename(d))) + + +if os.path.exists('staging'): + shutil.rmtree('staging') +shutil.copytree('apparmor', 'staging') + +# Support the --version=... since this will be part of a Makefile +version = "unknown-version" +if "--version=" in sys.argv[-1]: + version=sys.argv[-1].split('=')[1] + sys.argv = sys.argv[0:-1] + +setup (name='apparmor', + version=version, + description='Python libraries for AppArmor utilities', + long_description='Python libraries for AppArmor utilities', + author='AppArmor Developers', + author_email='apparmor@lists.ubuntu.com', + url='https://launchpad.net/apparmor', + license='GPL-2', + cmdclass={'install': Install}, + package_dir={'apparmor': 'staging'}, + py_modules=['apparmor.easyprof'] +) + +shutil.rmtree('staging') Index: apparmor-debian/utils/test/easyprof.conf =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-debian/utils/test/easyprof.conf 2012-04-24 11:27:49.796061491 -0700 @@ -0,0 +1,5 @@ +# Location of system policygroups +POLICYGROUPS_DIR="./policygroups" + +# Location of system templates +TEMPLATES_DIR="./templates" Index: apparmor-debian/utils/test/test-aa-easyprof.py =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-debian/utils/test/test-aa-easyprof.py 2012-04-24 11:27:49.796061491 -0700 @@ -0,0 +1,882 @@ +#! /usr/bin/env python +# ------------------------------------------------------------------ +# +# Copyright (C) 2011-2012 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +import glob +import os +import shutil +import sys +import tempfile +import unittest + +topdir = None +debugging = False + +def recursive_rm(dirPath, contents_only=False): + '''recursively remove directory''' + names = os.listdir(dirPath) + for name in names: + path = os.path.join(dirPath, name) + if os.path.islink(path) or not os.path.isdir(path): + os.unlink(path) + else: + recursive_rm(path) + if contents_only == False: + os.rmdir(dirPath) + +# +# Our test class +# +class T(unittest.TestCase): + def setUp(self): + '''Setup for tests''' + global topdir + + self.tmpdir = tempfile.mkdtemp(prefix='test-aa-easyprof') + + # Copy everything into place + for d in ['easyprof/policygroups', 'easyprof/templates']: + shutil.copytree(os.path.join(topdir, d), os.path.join(self.tmpdir, os.path.basename(d))) + + # Create a test template + self.test_template = "test-template" + contents = '''# vim:syntax=apparmor +# %s +# AppArmor policy for ###NAME### +# ###AUTHOR### +# ###COPYRIGHT### +# ###COMMENT### + +#include + +###VAR### + +###BINARY### { + #include + + ###ABSTRACTIONS### + + ###POLICYGROUPS### + + ###READS### + + ###WRITES### +} + +''' % (self.test_template) + open(os.path.join(self.tmpdir, 'templates', self.test_template), 'w').write(contents) + + # Create a test policygroup + self.test_policygroup = "test-policygroup" + contents = ''' + # %s + #include + #include +''' % (self.test_policygroup) + open(os.path.join(self.tmpdir, 'policygroups', self.test_policygroup), 'w').write(contents) + + # setup our conffile + self.conffile = os.path.join(self.tmpdir, 'easyprof.conf') + contents = ''' +POLICYGROUPS_DIR="%s/policygroups" +TEMPLATES_DIR="%s/templates" +''' % (self.tmpdir, self.tmpdir) + open(self.conffile, 'w').write(contents) + + self.binary = "/opt/bin/foo" + self.full_args = ['-c', self.conffile, self.binary] + + if debugging: + self.full_args.append('-d') + + (self.options, self.args) = easyprof.parse_args(self.full_args + [self.binary]) + + def tearDown(self): + '''Teardown for tests''' + if os.path.exists(self.tmpdir): + recursive_rm(self.tmpdir) + +# +# config file tests +# + def test_configuration_file_p_invalid(self): + '''Test config parsing (invalid POLICYGROUPS_DIR)''' + contents = ''' +POLICYGROUPS_DIR= +TEMPLATES_DIR="%s/templates" +''' % (self.tmpdir) + + open(self.conffile, 'w').write(contents) + try: + easyprof.AppArmorEasyProfile(self.binary, self.options) + except easyprof.AppArmorException: + return + except Exception: + raise + + raise Exception ("File should have been invalid") + + def test_configuration_file_p_empty(self): + '''Test config parsing (empty POLICYGROUPS_DIR)''' + contents = ''' +POLICYGROUPS_DIR="%s" +TEMPLATES_DIR="%s/templates" +''' % ('', self.tmpdir) + + open(self.conffile, 'w').write(contents) + try: + easyprof.AppArmorEasyProfile(self.binary, self.options) + except easyprof.AppArmorException: + return + except Exception: + raise + + raise Exception ("File should have been invalid") + + def test_configuration_file_p_nonexistent(self): + '''Test config parsing (nonexistent POLICYGROUPS_DIR)''' + contents = ''' +POLICYGROUPS_DIR="%s/policygroups" +TEMPLATES_DIR="%s/templates" +''' % ('/nonexistent', self.tmpdir) + + open(self.conffile, 'w').write(contents) + try: + easyprof.AppArmorEasyProfile(self.binary, self.options) + except easyprof.AppArmorException: + return + except Exception: + raise + + raise Exception ("File should have been invalid") + + def test_policygroups_dir_relative(self): + '''Test --policy-groups-dir (relative DIR)''' + os.chdir(self.tmpdir) + rel = os.path.join(self.tmpdir, 'relative') + os.mkdir(rel) + shutil.copy(os.path.join(self.tmpdir, 'policygroups', self.test_policygroup), os.path.join(rel, self.test_policygroup)) + + args = self.full_args + args += ['--policy-groups-dir', './relative', '--show-policy-group', '--policy-groups=%s' % self.test_policygroup] + (self.options, self.args) = easyprof.parse_args(args) + easyp = easyprof.AppArmorEasyProfile(self.binary, self.options) + + # no fallback + self.assertTrue(easyp.dirs['policygroups'] == rel, "Not using specified --policy-groups-dir") + self.assertFalse(easyp.get_policy_groups() == None, "Could not find policy-groups") + + def test_policygroups_dir_nonexistent(self): + '''Test --policy-groups-dir (nonexistent DIR)''' + os.chdir(self.tmpdir) + rel = os.path.join(self.tmpdir, 'nonexistent') + + args = self.full_args + args += ['--policy-groups-dir', rel, '--show-policy-group', '--policy-groups=%s' % self.test_policygroup] + (self.options, self.args) = easyprof.parse_args(args) + easyp = easyprof.AppArmorEasyProfile(self.binary, self.options) + + # test if using fallback + self.assertFalse(easyp.dirs['policygroups'] == rel, "Using nonexistent --policy-groups-dir") + + # test fallback + self.assertTrue(easyp.get_policy_groups() != None, "Found policy-groups when shouldn't have") + + def test_policygroups_dir_valid(self): + '''Test --policy-groups-dir (valid DIR)''' + os.chdir(self.tmpdir) + valid = os.path.join(self.tmpdir, 'valid') + os.mkdir(valid) + shutil.copy(os.path.join(self.tmpdir, 'policygroups', self.test_policygroup), os.path.join(valid, self.test_policygroup)) + + args = self.full_args + args += ['--policy-groups-dir', valid, '--show-policy-group', '--policy-groups=%s' % self.test_policygroup] + (self.options, self.args) = easyprof.parse_args(args) + easyp = easyprof.AppArmorEasyProfile(self.binary, self.options) + + # no fallback + self.assertTrue(easyp.dirs['policygroups'] == valid, "Not using specified --policy-groups-dir") + self.assertFalse(easyp.get_policy_groups() == None, "Could not find policy-groups") + + def test_configuration_file_t_invalid(self): + '''Test config parsing (invalid TEMPLATES_DIR)''' + contents = ''' +TEMPLATES_DIR= +POLICYGROUPS_DIR="%s/templates" +''' % (self.tmpdir) + + open(self.conffile, 'w').write(contents) + try: + easyprof.AppArmorEasyProfile(self.binary, self.options) + except easyprof.AppArmorException: + return + except Exception: + raise + + raise Exception ("File should have been invalid") + + def test_configuration_file_t_empty(self): + '''Test config parsing (empty TEMPLATES_DIR)''' + contents = ''' +TEMPLATES_DIR="%s" +POLICYGROUPS_DIR="%s/templates" +''' % ('', self.tmpdir) + + open(self.conffile, 'w').write(contents) + try: + easyprof.AppArmorEasyProfile(self.binary, self.options) + except easyprof.AppArmorException: + return + except Exception: + raise + + raise Exception ("File should have been invalid") + + def test_configuration_file_t_nonexistent(self): + '''Test config parsing (nonexistent TEMPLATES_DIR)''' + contents = ''' +TEMPLATES_DIR="%s/policygroups" +POLICYGROUPS_DIR="%s/templates" +''' % ('/nonexistent', self.tmpdir) + + open(self.conffile, 'w').write(contents) + try: + easyprof.AppArmorEasyProfile(self.binary, self.options) + except easyprof.AppArmorException: + return + except Exception: + raise + + raise Exception ("File should have been invalid") + + def test_templates_dir_relative(self): + '''Test --templates-dir (relative DIR)''' + os.chdir(self.tmpdir) + rel = os.path.join(self.tmpdir, 'relative') + os.mkdir(rel) + shutil.copy(os.path.join(self.tmpdir, 'templates', self.test_template), os.path.join(rel, self.test_template)) + + args = self.full_args + args += ['--templates-dir', './relative', '--show-template', '--template=%s' % self.test_template] + (self.options, self.args) = easyprof.parse_args(args) + easyp = easyprof.AppArmorEasyProfile(self.binary, self.options) + + # no fallback + self.assertTrue(easyp.dirs['templates'] == rel, "Not using specified --template-dir") + self.assertFalse(easyp.get_templates() == None, "Could not find templates") + + def test_templates_dir_nonexistent(self): + '''Test --templates-dir (nonexistent DIR)''' + os.chdir(self.tmpdir) + rel = os.path.join(self.tmpdir, 'nonexistent') + + args = self.full_args + args += ['--templates-dir', rel, '--show-template', '--template=%s' % self.test_template] + (self.options, self.args) = easyprof.parse_args(args) + easyp = easyprof.AppArmorEasyProfile(self.binary, self.options) + + # test if using fallback + self.assertFalse(easyp.dirs['templates'] == rel, "Using nonexistent --template-dir") + + # test fallback + self.assertTrue(easyp.get_templates() != None, "Found templates when shouldn't have") + + def test_templates_dir_valid(self): + '''Test --templates-dir (valid DIR)''' + os.chdir(self.tmpdir) + valid = os.path.join(self.tmpdir, 'valid') + os.mkdir(valid) + shutil.copy(os.path.join(self.tmpdir, 'templates', self.test_template), os.path.join(valid, self.test_template)) + + args = self.full_args + args += ['--templates-dir', valid, '--show-template', '--template=%s' % self.test_template] + (self.options, self.args) = easyprof.parse_args(args) + easyp = easyprof.AppArmorEasyProfile(self.binary, self.options) + + # no fallback + self.assertTrue(easyp.dirs['templates'] == valid, "Not using specified --template-dir") + self.assertFalse(easyp.get_templates() == None, "Could not find templates") + +# +# Binary file tests +# + def test_binary(self): + '''Test binary''' + easyprof.AppArmorEasyProfile('/bin/ls', self.options) + + def test_binary_nonexistent(self): + '''Test binary (nonexistent)''' + easyprof.AppArmorEasyProfile(os.path.join(self.tmpdir, 'nonexistent'), self.options) + + def test_binary_relative(self): + '''Test binary (relative)''' + try: + easyprof.AppArmorEasyProfile('./foo', self.options) + except easyprof.AppArmorException: + return + except Exception: + raise + raise Exception ("Binary should have been invalid") + + def test_binary_symlink(self): + '''Test binary (symlink)''' + exe = os.path.join(self.tmpdir, 'exe') + open(exe, 'wa').close() + symlink = exe + ".lnk" + os.symlink(exe, symlink) + + try: + easyprof.AppArmorEasyProfile(symlink, self.options) + except easyprof.AppArmorException: + return + except Exception: + raise + raise Exception ("Binary should have been invalid") + +# +# Templates tests +# + def test_templates_list(self): + '''Test templates (list)''' + args = self.full_args + args.append('--list-templates') + (self.options, self.args) = easyprof.parse_args(args) + + easyp = easyprof.AppArmorEasyProfile(None, self.options) + for i in easyp.get_templates(): + self.assertTrue(os.path.exists(i), "Could not find '%s'" % i) + + def test_templates_show(self): + '''Test templates (show)''' + files = [] + for f in glob.glob("%s/templates/*" % self.tmpdir): + files.append(f) + + for f in files: + args = self.full_args + args += ['--show-template', '--template', f] + (self.options, self.args) = easyprof.parse_args(args) + easyp = easyprof.AppArmorEasyProfile(None, self.options) + + path = os.path.join(easyp.dirs['templates'], f) + self.assertTrue(os.path.exists(path), "Could not find '%s'" % path) + open(path).read() + +# +# Policygroups tests +# + def test_policygroups_list(self): + '''Test policygroups (list)''' + args = self.full_args + args.append('--list-policy-groups') + (self.options, self.args) = easyprof.parse_args(args) + + easyp = easyprof.AppArmorEasyProfile(None, self.options) + for i in easyp.get_templates(): + self.assertTrue(os.path.exists(i), "Could not find '%s'" % i) + + def test_policygroups_show(self): + '''Test policygroups (show)''' + files = [] + for f in glob.glob("%s/policygroups/*" % self.tmpdir): + files.append(f) + + for f in files: + args = self.full_args + args += ['--show-template', '--template', f] + (self.options, self.args) = easyprof.parse_args(args) + easyp = easyprof.AppArmorEasyProfile(None, self.options) + + path = os.path.join(easyp.dirs['policygroups'], f) + self.assertTrue(os.path.exists(path), "Could not find '%s'" % path) + open(path).read() + +# +# Test genpolicy +# + def _gen_policy(self, name=None, template=None, extra_args=[]): + '''Generate a policy''' + # Build up our args + args = self.full_args + + if template == None: + args.append('--template=%s' % self.test_template) + else: + args.append('--template=%s' % template) + + if name != None: + args.append('--name=%s' % name) + + if len(extra_args) > 0: + args += extra_args + + args.append(self.binary) + + # Now parse our args + (self.options, self.args) = easyprof.parse_args(args) + easyp = easyprof.AppArmorEasyProfile(self.binary, self.options) + params = easyprof.gen_policy_params(self.binary, self.options) + p = easyp.gen_policy(**params) + + # We always need to check for these + search_terms = [self.binary] + if name != None: + search_terms.append(name) + + if template == None: + search_terms.append(self.test_template) + + for s in search_terms: + self.assertTrue(s in p, "Could not find '%s' in:\n%s" % (s, p)) + + # ###NAME### should be replaced with self.binary or 'name'. Check for that + inv_s = '###NAME###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + if debugging: + print p + + return p + + def test_genpolicy_templates_abspath(self): + '''Test genpolicy (abspath to template)''' + # create a new template + template = os.path.join(self.tmpdir, "test-abspath-template") + shutil.copy(os.path.join(self.tmpdir, 'templates', self.test_template), template) + contents = open(template).read() + test_string = "#teststring" + open(template, 'w').write(contents + "\n%s\n" % test_string) + + p = self._gen_policy(template=template) + + for s in [self.test_template, test_string]: + self.assertTrue(s in p, "Could not find '%s' in:\n%s" % (s, p)) + + def test_genpolicy_templates_system(self): + '''Test genpolicy (system template)''' + self._gen_policy() + + def test_genpolicy_templates_nonexistent(self): + '''Test genpolicy (nonexistent template)''' + try: + self._gen_policy(template=os.path.join(self.tmpdir, "/nonexistent")) + except easyprof.AppArmorException: + return + except Exception: + raise + raise Exception ("template should be invalid") + + def test_genpolicy_name(self): + '''Test genpolicy (name)''' + self._gen_policy(name='test-foo') + + def test_genpolicy_comment(self): + '''Test genpolicy (comment)''' + s = "test comment" + p = self._gen_policy(extra_args=['--comment=%s' % s]) + self.assertTrue(s in p, "Could not find '%s' in:\n%s" % (s, p)) + inv_s = '###COMMENT###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_author(self): + '''Test genpolicy (author)''' + s = "Archibald Poindexter" + p = self._gen_policy(extra_args=['--author=%s' % s]) + self.assertTrue(s in p, "Could not find '%s' in:\n%s" % (s, p)) + inv_s = '###AUTHOR###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_copyright(self): + '''Test genpolicy (copyright)''' + s = "2112/01/01" + p = self._gen_policy(extra_args=['--copyright=%s' % s]) + self.assertTrue(s in p, "Could not find '%s' in:\n%s" % (s, p)) + inv_s = '###COPYRIGHT###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_abstractions(self): + '''Test genpolicy (single abstraction)''' + s = "nameservice" + p = self._gen_policy(extra_args=['--abstractions=%s' % s]) + search = "#include " % s + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###ABSTRACTIONS###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_abstractions_multiple(self): + '''Test genpolicy (multiple abstractions)''' + abstractions = "authentication,X,user-tmp" + p = self._gen_policy(extra_args=['--abstractions=%s' % abstractions]) + for s in abstractions.split(','): + search = "#include " % s + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###ABSTRACTIONS###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_policygroups(self): + '''Test genpolicy (single policygroup)''' + groups = self.test_policygroup + p = self._gen_policy(extra_args=['--policy-groups=%s' % groups]) + + for s in ['#include ', '#include ']: + self.assertTrue(s in p, "Could not find '%s' in:\n%s" % (s, p)) + inv_s = '###POLICYGROUPS###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_policygroups_multiple(self): + '''Test genpolicy (multiple policygroups)''' + test_policygroup2 = "test-policygroup2" + contents = ''' + # %s + #include + #include +''' % (self.test_policygroup) + open(os.path.join(self.tmpdir, 'policygroups', test_policygroup2), 'w').write(contents) + + groups = "%s,%s" % (self.test_policygroup, test_policygroup2) + p = self._gen_policy(extra_args=['--policy-groups=%s' % groups]) + + for s in ['#include ', + '#include ', + '#include ', + '#include ']: + self.assertTrue(s in p, "Could not find '%s' in:\n%s" % (s, p)) + inv_s = '###POLICYGROUPS###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_policygroups_nonexistent(self): + '''Test genpolicy (nonexistent policygroup)''' + try: + self._gen_policy(extra_args=['--policy-groups=nonexistent']) + except easyprof.AppArmorException: + return + except Exception: + raise + raise Exception ("policygroup should be invalid") + + def test_genpolicy_readpath_file(self): + '''Test genpolicy (read-path file)''' + s = "/opt/test-foo" + p = self._gen_policy(extra_args=['--read-path=%s' % s]) + search = "%s r," % s + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_readpath_home_file(self): + '''Test genpolicy (read-path file in /home)''' + s = "/home/*/test-foo" + p = self._gen_policy(extra_args=['--read-path=%s' % s]) + search = "owner %s r," % s + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_readpath_homevar_file(self): + '''Test genpolicy (read-path file in @{HOME})''' + s = "@{HOME}/test-foo" + p = self._gen_policy(extra_args=['--read-path=%s' % s]) + search = "owner %s r," % s + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_readpath_homedirs_file(self): + '''Test genpolicy (read-path file in @{HOMEDIRS})''' + s = "@{HOMEDIRS}/test-foo" + p = self._gen_policy(extra_args=['--read-path=%s' % s]) + search = "owner %s r," % s + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_readpath_dir(self): + '''Test genpolicy (read-path directory/)''' + s = "/opt/test-foo-dir/" + p = self._gen_policy(extra_args=['--read-path=%s' % s]) + search_terms = ["%s r," % s, "%s** r," % s] + for search in search_terms: + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_readpath_dir_glob(self): + '''Test genpolicy (read-path directory/*)''' + s = "/opt/test-foo-dir/*" + p = self._gen_policy(extra_args=['--read-path=%s' % s]) + search_terms = ["%s r," % os.path.dirname(s), "%s r," % s] + for search in search_terms: + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_readpath_dir_glob_all(self): + '''Test genpolicy (read-path directory/**)''' + s = "/opt/test-foo-dir/**" + p = self._gen_policy(extra_args=['--read-path=%s' % s]) + search_terms = ["%s r," % os.path.dirname(s), "%s r," % s] + for search in search_terms: + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_readpath_multiple(self): + '''Test genpolicy (read-path multiple)''' + paths = ["/opt/test-foo", + "/home/*/test-foo", + "@{HOME}/test-foo", + "@{HOMEDIRS}/test-foo", + "/opt/test-foo-dir/", + "/opt/test-foo-dir/*", + "/opt/test-foo-dir/**"] + args = [] + search_terms = [] + for s in paths: + args.append('--read-path=%s' % s) + # This mimics easyprof.gen_path_rule() + owner = "" + if s.startswith('/home/') or s.startswith("@{HOME"): + owner = "owner " + if s.endswith('/'): + search_terms.append("%s r," % (s)) + search_terms.append("%s%s** r," % (owner, s)) + elif s.endswith('/**') or s.endswith('/*'): + search_terms.append("%s r," % (os.path.dirname(s))) + search_terms.append("%s%s r," % (owner, s)) + else: + search_terms.append("%s%s r," % (owner, s)) + + p = self._gen_policy(extra_args=args) + for search in search_terms: + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_readpath_bad(self): + '''Test genpolicy (read-path bad)''' + s = "bar" + try: + self._gen_policy(extra_args=['--read-path=%s' % s]) + except easyprof.AppArmorException: + return + except Exception: + raise + raise Exception ("read-path should be invalid") + + def test_genpolicy_writepath_file(self): + '''Test genpolicy (write-path file)''' + s = "/opt/test-foo" + p = self._gen_policy(extra_args=['--write-path=%s' % s]) + search = "%s rwk," % s + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_writepath_home_file(self): + '''Test genpolicy (write-path file in /home)''' + s = "/home/*/test-foo" + p = self._gen_policy(extra_args=['--write-path=%s' % s]) + search = "owner %s rwk," % s + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_writepath_homevar_file(self): + '''Test genpolicy (write-path file in @{HOME})''' + s = "@{HOME}/test-foo" + p = self._gen_policy(extra_args=['--write-path=%s' % s]) + search = "owner %s rwk," % s + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_writepath_homedirs_file(self): + '''Test genpolicy (write-path file in @{HOMEDIRS})''' + s = "@{HOMEDIRS}/test-foo" + p = self._gen_policy(extra_args=['--write-path=%s' % s]) + search = "owner %s rwk," % s + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_writepath_dir(self): + '''Test genpolicy (write-path directory/)''' + s = "/opt/test-foo-dir/" + p = self._gen_policy(extra_args=['--write-path=%s' % s]) + search_terms = ["%s rwk," % s, "%s** rwk," % s] + for search in search_terms: + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_writepath_dir_glob(self): + '''Test genpolicy (write-path directory/*)''' + s = "/opt/test-foo-dir/*" + p = self._gen_policy(extra_args=['--write-path=%s' % s]) + search_terms = ["%s rwk," % os.path.dirname(s), "%s rwk," % s] + for search in search_terms: + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_writepath_dir_glob_all(self): + '''Test genpolicy (write-path directory/**)''' + s = "/opt/test-foo-dir/**" + p = self._gen_policy(extra_args=['--write-path=%s' % s]) + search_terms = ["%s rwk," % os.path.dirname(s), "%s rwk," % s] + for search in search_terms: + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_writepath_multiple(self): + '''Test genpolicy (write-path multiple)''' + paths = ["/opt/test-foo", + "/home/*/test-foo", + "@{HOME}/test-foo", + "@{HOMEDIRS}/test-foo", + "/opt/test-foo-dir/", + "/opt/test-foo-dir/*", + "/opt/test-foo-dir/**"] + args = [] + search_terms = [] + for s in paths: + args.append('--write-path=%s' % s) + # This mimics easyprof.gen_path_rule() + owner = "" + if s.startswith('/home/') or s.startswith("@{HOME"): + owner = "owner " + if s.endswith('/'): + search_terms.append("%s rwk," % (s)) + search_terms.append("%s%s** rwk," % (owner, s)) + elif s.endswith('/**') or s.endswith('/*'): + search_terms.append("%s rwk," % (os.path.dirname(s))) + search_terms.append("%s%s rwk," % (owner, s)) + else: + search_terms.append("%s%s rwk," % (owner, s)) + + p = self._gen_policy(extra_args=args) + for search in search_terms: + self.assertTrue(search in p, "Could not find '%s' in:\n%s" % (search, p)) + inv_s = '###READPATH###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_writepath_bad(self): + '''Test genpolicy (write-path bad)''' + s = "bar" + try: + self._gen_policy(extra_args=['--write-path=%s' % s]) + except easyprof.AppArmorException: + return + except Exception: + raise + raise Exception ("write-path should be invalid") + + def test_genpolicy_templatevar(self): + '''Test genpolicy (template-var single)''' + s = "@{FOO}=bar" + p = self._gen_policy(extra_args=['--template-var=%s' % s]) + self.assertTrue(s in p, "Could not find '%s' in:\n%s" % (s, p)) + inv_s = '###TEMPLATEVAR###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_templatevar_multiple(self): + '''Test genpolicy (template-var multiple)''' + variables = ["@{FOO}=bar", "@{BAR}=baz"] + args = [] + for s in variables: + args.append('--template-var=%s' % s) + + p = self._gen_policy(extra_args=args) + for s in variables: + self.assertTrue(s in p, "Could not find '%s' in:\n%s" % (s, p)) + inv_s = '###TEMPLATEVAR###' + self.assertFalse(inv_s in p, "Found '%s' in :\n%s" % (inv_s, p)) + + def test_genpolicy_templatevar_bad(self): + '''Test genpolicy (template-var bad)''' + s = "{FOO}=bar" + try: + self._gen_policy(extra_args=['--template-var=%s' % s]) + except easyprof.AppArmorException: + return + except Exception: + raise + raise Exception ("template-var should be invalid") + + def test_genpolicy_invalid_template_policy(self): + '''Test genpolicy (invalid template policy)''' + # create a new template + template = os.path.join(self.tmpdir, "test-invalid-template") + shutil.copy(os.path.join(self.tmpdir, 'templates', self.test_template), template) + contents = open(template).read() + bad_pol = "" + bad_string = "bzzzt" + for line in contents.splitlines(): + if '}' in line: + bad_pol += bad_string + else: + bad_pol += line + bad_pol += "\n" + open(template, 'w').write(bad_pol) + try: + self._gen_policy(template=template) + except easyprof.AppArmorException: + return + except Exception: + raise + raise Exception ("policy should be invalid") + + +# +# End test class +# + +# +# Main +# +if __name__ == '__main__': + def cleanup(files): + for f in files: + if os.path.exists(f): + os.unlink(f) + + absfn = os.path.abspath(sys.argv[0]) + topdir = os.path.dirname(os.path.dirname(absfn)) + + if len(sys.argv) > 1 and (sys.argv[1] == '-d' or sys.argv[1] == '--debug'): + debugging = True + + created = [] + + # Create the necessary files to import aa-easyprof + init = os.path.join(os.path.dirname(absfn), '__init__.py') + if not os.path.exists(init): + open(init, 'wa').close() + created.append(init) + + symlink = os.path.join(os.path.dirname(absfn), 'easyprof.py') + if not os.path.exists(symlink): + os.symlink(os.path.join(topdir, 'apparmor', 'easyprof.py'), symlink) + created.append(symlink) + created.append(symlink + 'c') + + # Now that we have everything we need, import aa-easyprof + import easyprof + + # run the tests + suite = unittest.TestSuite() + suite.addTest(unittest.TestLoader().loadTestsFromTestCase(T)) + rc = unittest.TextTestRunner(verbosity=2).run(suite) + + cleanup(created) + + if not rc.wasSuccessful(): + sys.exit(1) Index: apparmor-debian/utils/apparmor/__init__.py =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-debian/utils/apparmor/__init__.py 2012-04-24 11:27:49.796061491 -0700 @@ -0,0 +1,9 @@ +# ------------------------------------------------------------------ +# +# Copyright (C) 2011-2012 Canonical Ltd. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ debian/patches/0002-add-debian-integration-to-lighttpd.patch0000644000000000000000000000161611773235147020761 0ustar Author: https://launchpad.net/~teka101 Description: Add entries for lighttpd to work in a Debian/Ubuntu install Forwarded: no (Debian/Ubuntu specific) Ubuntu-Bug: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/582814 Index: apparmor-2.6.1/profiles/apparmor/profiles/extras/usr.sbin.lighttpd =================================================================== --- apparmor-2.6.1.orig/profiles/apparmor/profiles/extras/usr.sbin.lighttpd 2011-04-18 09:19:36.000000000 -0500 +++ apparmor-2.6.1/profiles/apparmor/profiles/extras/usr.sbin.lighttpd 2011-04-18 09:22:00.000000000 -0500 @@ -52,5 +52,13 @@ /bin/bash mix, /bin/zsh mix, /bin/cat mix, + + # Debian/Ubuntu integration in default installation + #include + /etc/mime.types r, + /usr/share/lighttpd/ r, + /usr/share/lighttpd/*.pl rmix, + /etc/lighttpd/conf-enabled/ r, + /etc/lighttpd/conf-enabled/*.conf r, } debian/patches/0001-add-chromium-browser.patch0000644000000000000000000001334711773235147016270 0ustar Author: Jamie Strandboge Description: chromium-browser profile Forwarded: yes Index: apparmor-2.7.100/profiles/apparmor.d/usr.bin.chromium-browser =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ apparmor-2.7.100/profiles/apparmor.d/usr.bin.chromium-browser 2012-03-09 11:27:18.000000000 -0600 @@ -0,0 +1,170 @@ +# Author: Jamie Strandboge +#include + +# We need 'flags=(attach_disconnected)' in newer chromium versions +/usr/lib/chromium-browser/chromium-browser flags=(attach_disconnected) { + #include + #include + #include + #include + #include + #include + #include + #include + #include + + # This include specifies which ubuntu-browsers.d abstractions to use. Eg, if + # you want access to productivity applications, adjust the following file + # accordingly. + #include + + # Networking + network inet stream, + network inet6 stream, + @{PROC}/[0-9]*/net/if_inet6 r, + @{PROC}/[0-9]*/net/ipv6_route r, + + # Should maybe be in abstractions + /etc/mime.types r, + /etc/mailcap r, + /etc/xdg/xubuntu/applications/defaults.list r, + owner @{HOME}/.local/share/applications/defaults.list r, + owner @{HOME}/.local/share/applications/mimeinfo.cache r, + + @{PROC}/[0-9]*/fd/ r, + @{PROC}/filesystems r, + @{PROC}/ r, + @{PROC}/[0-9]*/task/[0-9]*/stat r, + owner @{PROC}/[0-9]*/cmdline r, + owner @{PROC}/[0-9]*/io r, + owner @{PROC}/[0-9]*/stat r, + owner @{PROC}/[0-9]*/status r, + + # Newer chromium needs these now + /sys/devices/pci[0-9]*/**/class r, + /sys/devices/pci[0-9]*/**/device r, + /sys/devices/pci[0-9]*/**/irq r, + /sys/devices/pci[0-9]*/**/resource r, + /sys/devices/pci[0-9]*/**/vendor r, + + # Needed for the crash reporter + owner @{PROC}/[0-9]*/auxv r, + + # chromium mmaps all kinds of things for speed. + /etc/passwd m, + /usr/share/fonts/truetype/**/*.tt[cf] m, + /usr/share/fonts/**/*.pfb m, + /usr/share/mime/mime.cache m, + /usr/share/icons/**/*.cache m, + owner /{dev,run}/shm/pulse-shm* m, + owner @{HOME}/.local/share/mime/mime.cache m, + owner /tmp/** m, + + @{PROC}/sys/kernel/shmmax r, + owner /{dev,run}/shm/{,.}org.chromium.* mrw, + + /usr/lib/chromium-browser/*.pak mr, + /usr/lib/chromium-browser/locales/* mr, + + # Noisy + deny /usr/lib/chromium-browser/** w, + + # Make browsing directories work + / r, + /**/ r, + + # Allow access to documentation and other files the user may want to look + # at in /usr + /usr/{include,share,src}** r, + + # Default profile allows downloads to ~/Downloads and uploads from ~/Public + owner @{HOME}/ r, + owner @{HOME}/Public/ r, + owner @{HOME}/Public/* r, + owner @{HOME}/Downloads/ r, + owner @{HOME}/Downloads/* rw, + + # Helpers + /usr/bin/xdg-open ixr, + /usr/bin/gnome-open ixr, + /usr/bin/gvfs-open ixr, + # TODO: kde, xfce + + # Importing firefox settings (requires 'r' access to @{HOME}/.mozilla/** + # which is provided by abstractions/ubuntu-browsers.d/user-files). + @{PROC}/[0-9]*/oom_{,score_}adj w, + /etc/firefox/profile/bookmarks.html r, + owner @{HOME}/.mozilla/** k, + + # Chromium configuration + owner @{HOME}/.pki/nssdb/* rwk, + owner @{HOME}/.cache/chromium/ rw, + owner @{HOME}/.cache/chromium/** rw, + owner @{HOME}/.cache/chromium/Cache/* mr, + owner @{HOME}/.config/chromium/ rw, + owner @{HOME}/.config/chromium/** rwk, + owner @{HOME}/.config/chromium/**/Cache/* mr, + owner @{HOME}/.config/chromium/Dictionaries/*.bdic mr, + owner @{HOME}/.config/chromium/**/Dictionaries/*.bdic mr, + + # Allow transitions to ourself and our sandbox + /usr/lib/chromium-browser/chromium-browser ix, + /usr/lib/chromium-browser/chromium-browser-sandbox cx -> chromium_browser_sandbox, + + # TODO: child profile + /bin/ps Uxr, + /usr/lib/chromium-browser/xdg-settings Ux, + /usr/bin/xdg-settings Ux, + + # Site-specific additions and overrides. See local/README for details. + #include + +profile chromium_browser_sandbox { + # Be fanatical since it is setuid root and don't use an abstraction + /lib/libgcc_s.so* mr, + /lib{,32,64}/libm-*.so* mr, + /lib/@{multiarch}/libm-*.so* mr, + /lib{,32,64}/libpthread-*.so* mr, + /lib/@{multiarch}/libpthread-*.so* mr, + /lib{,32,64}/libc-*.so* mr, + /lib/@{multiarch}/libc-*.so* mr, + /lib{,32,64}/libld-*.so* mr, + /lib/@{multiarch}/libld-*.so* mr, + /lib{,32,64}/ld-*.so* mr, + /lib/@{multiarch}/ld-*.so* mr, + /lib/tls/*/{cmov,nosegneg}/libm-*.so* mr, + /lib/tls/*/{cmov,nosegneg}/libpthread-*.so* mr, + /lib/tls/*/{cmov,nosegneg}/libc-*.so* mr, + /usr/lib/libstdc++.so* mr, + /etc/ld.so.cache r, + + # Required for dropping into PID namespace. Keep in mind that until the + # process drops this capability it can escape confinement, but once it + # drops CAP_SYS_ADMIN we are ok. + capability sys_admin, + + # All of these are for sanely dropping from root and chrooting + capability chown, + capability fsetid, + capability setgid, + capability setuid, + capability dac_override, + capability sys_chroot, + + # *Sigh* + capability sys_ptrace, + + @{PROC}/ r, + @{PROC}/[0-9]*/ r, + @{PROC}/[0-9]*/fd/ r, + @{PROC}/[0-9]*/oom_adj w, + @{PROC}/[0-9]*/oom_score_adj w, + @{PROC}/[0-9]*/task/[0-9]*/stat r, + + /usr/bin/chromium-browser r, + /usr/lib/chromium-browser/chromium-browser Px, + /usr/lib/chromium-browser/chromium-browser-sandbox r, + + owner /tmp/** rw, + } +} debian/patches/series0000644000000000000000000000051312001061152012015 0ustar 0001-add-chromium-browser.patch 0002-add-debian-integration-to-lighttpd.patch 0003-add-aa-easyprof.patch 0004-lp941808.patch 0007-ubuntu-manpage-updates.patch notify-group.patch aa-status-smarter.patch abstractions-X.patch abstractions-ubuntu-browsers.patch pass-compiler-flags.patch non-linux.patch fix-network-rule-support.patch debian/apparmor.init0000644000000000000000000001076411773235147011716 0ustar #!/bin/sh # ---------------------------------------------------------------------- # Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 # NOVELL (All rights reserved) # Copyright (c) 2008, 2009 Canonical, Ltd. # # This program is free software; you can redistribute it and/or # modify it under the terms of version 2 of the GNU General Public # License published by the Free Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, contact Novell, Inc. # ---------------------------------------------------------------------- # Authors: # Steve Beattie # Kees Cook # # /etc/init.d/apparmor # ### BEGIN INIT INFO # Provides: apparmor # Required-Start: $remote_fs # Required-Stop: umountfs # Default-Start: S # Default-Stop: # Short-Description: AppArmor initialization # Description: AppArmor init script. This script loads all AppArmor profiles. ### END INIT INFO . /lib/apparmor/functions . /lib/lsb/init-functions usage() { echo "Usage: $0 {start|stop|restart|reload|force-reload|status|recache}" } test -x ${PARSER} || exit 0 # by debian policy # LSM is built-in, so it is either there or not enabled for this boot test -d /sys/module/apparmor || exit 0 securityfs() { # Need securityfs for any mode if [ ! -d "${AA_SFS}" ]; then if cut -d" " -f2,3 /proc/mounts | grep -q "^${SECURITYFS} securityfs"'$' ; then log_action_msg "AppArmor not available as kernel LSM." log_end_msg 1 exit 1 else log_action_begin_msg "Mounting securityfs on ${SECURITYFS}" if ! mount -t securityfs none "${SECURITYFS}"; then log_action_end_msg 1 log_end_msg 1 exit 1 fi fi fi if [ ! -w "$AA_SFS"/.load ]; then log_action_msg "Insufficient privileges to change profiles." log_end_msg 1 exit 1 fi } # Allow "recache" even when running on the liveCD if [ "$1" = "recache" ]; then log_daemon_msg "Recaching AppArmor profiles" recache_profiles rc=$? log_end_msg "$rc" exit $rc fi # do not perform start/stop/reload actions when running from liveCD test -d /rofs/etc/apparmor.d && exit 0 rc=255 case "$1" in start) if [ -x /bin/running-in-container ] && /bin/running-in-container; then log_daemon_msg "Not starting AppArmor in container" log_end_msg 0 exit 0 fi log_daemon_msg "Starting AppArmor profiles" securityfs load_configured_profiles rc=$? log_end_msg "$rc" ;; stop) log_daemon_msg "Clearing AppArmor profiles cache" clear_cache rc=$? log_end_msg "$rc" cat >&2 < "$aa_configured" || exit 1 aa_loaded=$(mktemp -t aa-XXXXXX) running_profile_names > "$aa_loaded" || exit 1 LC_COLLATE=C comm -2 -3 "$aa_loaded" "$aa_configured" | while read profile ; do unload_profile "$profile" done rm -f "$aa_configured" "$aa_loaded" log_end_msg "$rc" ;; status) securityfs if [ -x /usr/sbin/aa-status ]; then aa-status --verbose else cat "$AA_SFS"/profiles fi rc=$? ;; *) usage rc=1 ;; esac exit $rc debian/apparmor-profiles.install0000644000000000000000000001474011773235147014240 0ustar debian/profiles/chromium-browser usr/share/apparmor-profiles/abstractions/ubuntu-browsers.d/ etc/apparmor.d/apache2.d/phpsysinfo etc/apparmor.d/bin.ping etc/apparmor.d/program-chunks/postfix-common etc/apparmor.d/sbin.klogd etc/apparmor.d/sbin.syslogd etc/apparmor.d/sbin.syslog-ng etc/apparmor.d/usr.bin.chromium-browser etc/apparmor.d/usr.lib.dovecot.deliver etc/apparmor.d/usr.lib.dovecot.dovecot-auth etc/apparmor.d/usr.lib.dovecot.imap etc/apparmor.d/usr.lib.dovecot.imap-login etc/apparmor.d/usr.lib.dovecot.managesieve-login etc/apparmor.d/usr.lib.dovecot.pop3 etc/apparmor.d/usr.lib.dovecot.pop3-login etc/apparmor.d/usr.sbin.avahi-daemon etc/apparmor.d/usr.sbin.dnsmasq etc/apparmor.d/usr.sbin.dovecot etc/apparmor.d/usr.sbin.identd etc/apparmor.d/usr.sbin.mdnsd etc/apparmor.d/usr.sbin.nmbd etc/apparmor.d/usr.sbin.nscd etc/apparmor.d/usr.sbin.smbd etc/apparmor.d/usr.sbin.traceroute usr/share/doc/apparmor-profiles/extras/README usr/share/doc/apparmor-profiles/extras/bin.netstat usr/share/doc/apparmor-profiles/extras/etc.cron.daily.logrotate usr/share/doc/apparmor-profiles/extras/etc.cron.daily.slocate.cron usr/share/doc/apparmor-profiles/extras/etc.cron.daily.tmpwatch usr/share/doc/apparmor-profiles/extras/sbin.dhclient usr/share/doc/apparmor-profiles/extras/sbin.dhcpcd usr/share/doc/apparmor-profiles/extras/sbin.portmap usr/share/doc/apparmor-profiles/extras/sbin.resmgrd usr/share/doc/apparmor-profiles/extras/sbin.rpc.lockd usr/share/doc/apparmor-profiles/extras/sbin.rpc.statd usr/share/doc/apparmor-profiles/extras/usr.NX.bin.nxclient usr/share/doc/apparmor-profiles/extras/usr.bin.acroread usr/share/doc/apparmor-profiles/extras/usr.bin.apropos usr/share/doc/apparmor-profiles/extras/usr.bin.evolution-2.10 usr/share/doc/apparmor-profiles/extras/usr.bin.fam usr/share/doc/apparmor-profiles/extras/usr.bin.freshclam usr/share/doc/apparmor-profiles/extras/usr.bin.gaim usr/share/doc/apparmor-profiles/extras/usr.bin.man usr/share/doc/apparmor-profiles/extras/usr.bin.mlmmj-bounce usr/share/doc/apparmor-profiles/extras/usr.bin.mlmmj-maintd usr/share/doc/apparmor-profiles/extras/usr.bin.mlmmj-make-ml.sh usr/share/doc/apparmor-profiles/extras/usr.bin.mlmmj-process usr/share/doc/apparmor-profiles/extras/usr.bin.mlmmj-recieve usr/share/doc/apparmor-profiles/extras/usr.bin.mlmmj-send usr/share/doc/apparmor-profiles/extras/usr.bin.mlmmj-sub usr/share/doc/apparmor-profiles/extras/usr.bin.mlmmj-unsub usr/share/doc/apparmor-profiles/extras/usr.bin.opera usr/share/doc/apparmor-profiles/extras/usr.bin.passwd usr/share/doc/apparmor-profiles/extras/usr.bin.procmail usr/share/doc/apparmor-profiles/extras/usr.bin.skype usr/share/doc/apparmor-profiles/extras/usr.bin.spamc usr/share/doc/apparmor-profiles/extras/usr.bin.svnserve usr/share/doc/apparmor-profiles/extras/usr.bin.wireshark usr/share/doc/apparmor-profiles/extras/usr.bin.xfs usr/share/doc/apparmor-profiles/extras/usr.lib.GConf.2.gconfd-2 usr/share/doc/apparmor-profiles/extras/usr.lib.RealPlayer10.realplay usr/share/doc/apparmor-profiles/extras/usr.lib.bonobo.bonobo-activation-server usr/share/doc/apparmor-profiles/extras/usr.lib.evolution-data-server.evolution-data-server-1.10 usr/share/doc/apparmor-profiles/extras/usr.lib.firefox.firefox usr/share/doc/apparmor-profiles/extras/usr.lib.firefox.firefox.sh usr/share/doc/apparmor-profiles/extras/usr.lib.firefox.mozilla-xremote-client usr/share/doc/apparmor-profiles/extras/usr.lib.man-db.man usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.anvil usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.bounce usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.cleanup usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.discard usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.error usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.flush usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.lmtp usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.local usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.master usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.nqmgr usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.oqmgr usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.pickup usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.pipe usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.proxymap usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.qmgr usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.qmqpd usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.scache usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.showq usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.smtp usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.smtpd usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.spawn usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.tlsmgr usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.trivial-rewrite usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.verify usr/share/doc/apparmor-profiles/extras/usr.lib.postfix.virtual usr/share/doc/apparmor-profiles/extras/usr.lib64.GConf.2.gconfd-2 usr/share/doc/apparmor-profiles/extras/usr.sbin.cupsd usr/share/doc/apparmor-profiles/extras/usr.sbin.dhcpd usr/share/doc/apparmor-profiles/extras/usr.sbin.httpd2-prefork usr/share/doc/apparmor-profiles/extras/usr.sbin.imapd usr/share/doc/apparmor-profiles/extras/usr.sbin.in.fingerd usr/share/doc/apparmor-profiles/extras/usr.sbin.in.ftpd usr/share/doc/apparmor-profiles/extras/usr.sbin.in.ntalkd usr/share/doc/apparmor-profiles/extras/usr.sbin.ipop2d usr/share/doc/apparmor-profiles/extras/usr.sbin.ipop3d usr/share/doc/apparmor-profiles/extras/usr.sbin.lighttpd usr/share/doc/apparmor-profiles/extras/usr.sbin.nmbd usr/share/doc/apparmor-profiles/extras/usr.sbin.oidentd usr/share/doc/apparmor-profiles/extras/usr.sbin.popper usr/share/doc/apparmor-profiles/extras/usr.sbin.postalias usr/share/doc/apparmor-profiles/extras/usr.sbin.postdrop usr/share/doc/apparmor-profiles/extras/usr.sbin.postmap usr/share/doc/apparmor-profiles/extras/usr.sbin.postqueue usr/share/doc/apparmor-profiles/extras/usr.sbin.sendmail usr/share/doc/apparmor-profiles/extras/usr.sbin.sendmail.postfix usr/share/doc/apparmor-profiles/extras/usr.sbin.sendmail.sendmail usr/share/doc/apparmor-profiles/extras/usr.sbin.smbd usr/share/doc/apparmor-profiles/extras/usr.sbin.spamd usr/share/doc/apparmor-profiles/extras/usr.sbin.squid usr/share/doc/apparmor-profiles/extras/usr.sbin.sshd usr/share/doc/apparmor-profiles/extras/usr.sbin.useradd usr/share/doc/apparmor-profiles/extras/usr.sbin.userdel usr/share/doc/apparmor-profiles/extras/usr.sbin.vsftpd usr/share/doc/apparmor-profiles/extras/usr.sbin.xinetd debian/changelog0000644000000000000000000024511112035207705011045 0ustar apparmor (2.7.103-4+rpi1) wheezy-staging; urgency=low * add build-depends on gcc-4.7 -- Peter Michael Green Wed, 10 Oct 2012 06:03:36 +0000 apparmor (2.7.103-4) unstable; urgency=low * debian/apparmor-profiles.dirs: add directories we might collide with apparmor on during purge. * debian/patches/fix-network-rule-support.patch: handle lack of networking features correctly (Closes: 679597). -- Kees Cook Mon, 16 Jul 2012 11:52:42 -0700 apparmor (2.7.103-3) unstable; urgency=low * debian/control: drop deprecated XS-Python-Version (Closes: 673062). * debian/debhelper/postinst-apparmor: remove bashism (Closes: 678526). * debian/patches/pass-compiler-flags.patch: add LDFLAGS where needed. * debian/libapache2-mod-apparmor.lintian-overrides: verified safe glibc function use at compile-time. * debian/rules: call dh_lintian. -- Kees Cook Thu, 28 Jun 2012 23:23:27 -0700 apparmor (2.7.103-2) unstable; urgency=low * debian/patches/non-linux.patch: fix up build failures on non-Linux systems (Closes: 671040). * debian/control: require apparmor for apparmor-profiles, since abstraction tree needs to be created already. * debian/lib/apparmor/functions: silently handle lack of interface compat patch. * debian/apparmor-profiles.postrm: retain conffile list for purge logic (Closes: 656451). * debian/libapache2-mod-apparmor.{dirs,preinst}: add "disabled" directory to package file list correctly (Closes: 670431). * debian/control: bump standards version, no changes needed. -- Kees Cook Sat, 05 May 2012 09:57:10 -0700 apparmor (2.7.103-1) unstable; urgency=low * New upstream release, merge with Ubuntu, drop included patches: - 0005-clean-common-from-vim.patch - 0006-use-linux-capability-h.patch - 0008-apparmor-lp963756.patch - 0009-apparmor-lp959560-part1.patch - 0010-apparmor-lp959560-part2.patch - 0011-apparmor-lp872446.patch - 0012-apparmor-lp978584.patch - 0013-apparmor-lp800826.patch - 0014-apparmor-lp979095.patch - 0015-apparmor-lp963756.patch - 0016-apparmor-lp968956.patch - 0017-apparmor-lp979135.patch - Closes: 656451 * debian/control: url.sty has moved, add texlive-latex-recommended Build-Dep (Closes: 669537). * debian/patches/notify-group.patch, debian/apparmor-notify.install, debian/notify/notify.conf: Remove custom notify.conf file, and modify the upstream one instead, adjusting the group to "adm", thanks to Intrigeri (Closes: 660078). * debian/patches/aa-status-smarter.patch: fix up the logic for determining the enabled state of AppArmor, based on patch from Intrigeri (Closes: 661153). * debian/debhelper/postinst-apparmor: do not fail if AppArmor is not installed, thanks to Intrigeri (Closes: 668010). * debian/patches/abstractions-X.patch: add missing gdm3 path to X abstraction, thanks to Intrigeri (Closes: 660079). * debian/patches/abstractions-ubuntu-browsers.patch: include iceweasl in browser abstraction, thanks to Intrigeri (Closes: 661176). * debian/rules, debian/compat, debian/patches/pass-compiler-flags.patch, debian/control: bump to compat 9, export build flags, and make get them passed into the build. -- Kees Cook Tue, 24 Apr 2012 17:20:41 -0700 apparmor (2.7.102-0ubuntu3) precise; urgency=low [ Jamie Strandboge ] * debian/patches/0007-ubuntu-manpage-updates.patch: update apparmor(5) to describe Ubuntu's two-stage policy load and how to add utilize it when developing policy (LP: #974089) [ Serge Hallyn ] * debian/apparmor.init: do nothing in a container. This can be removed once stacked profiles are supported and used by lxc. (LP: #978297) [ Steve Beattie ] * debian/patches/0008-apparmor-lp963756.patch: Fix permission mapping for change_profile onexec (LP: #963756) * debian/patches/0009-apparmor-lp959560-part1.patch, debian/patches/0010-apparmor-lp959560-part2.patch: Update the parser to support the 'in' keyword for value lists, and make mount operations aware of 'in' keyword so they can affect the flags build list (LP: #959560) * debian/patches/0011-apparmor-lp872446.patch: fix logprof missing exec events in complain mode (LP: #872446) * debian/patches/0012-apparmor-lp978584.patch: allow inet6 access in dovecot imap-login profile (LP: #978584) * debian/patches/0013-apparmor-lp800826.patch: fix libapparmor log parsing library from dropping apparmor network events that contain ip addresses or ports in them (LP: #800826) * debian/patches/0014-apparmor-lp979095.patch: document new mount rule syntax and usage in apparmor.d(5) manpage (LP: #979095) * debian/patches/0015-apparmor-lp963756.patch: Fix change_onexec for profiles without attachment specification (LP: #963756, LP: #978038) * debian/patches/0016-apparmor-lp968956.patch: Fix protocol error when loading policy to kernels without compat patches (LP: #968956) * debian/patches/0017-apparmor-lp979135.patch: Fix change_profile to grant access to /proc/attr api (LP: #979135) -- Steve Beattie Thu, 12 Apr 2012 06:17:42 -0500 apparmor (2.7.102-0ubuntu2) precise; urgency=low * debian/control: Make dh-apparmor Multi-Arch: foreign, so that it can satisfy cross-build-dependencies. -- Colin Watson Sat, 31 Mar 2012 02:28:05 +0100 apparmor (2.7.102-0ubuntu1) precise; urgency=low * New upstream release. Fixes the following issues in support of LXC AppArmor support for beta-2: - Fix the return size of aa_getprocattr (LP: #962521) - Fix mnt_flags passed for remount - Fix dfa minimization around the nonmatching state - Factor all the permissions dump code into a single perms method * debian/apparmor-utils.install: - AppArmor now installs apparmor.vim. Move it into place - install aa-exec * debian/apparmor-utils.manpages: install aa-exec man page * debian/patches/0003-add-aa-easyprof.patch: refresh for Makefile changes * debian/patches/0005-clean-common-from-vim.patch: clean up 'common' symlink * 0006-use-linux-capability-h.patch: Use linux/capability.h instead of sys/capability.h -- Jamie Strandboge Thu, 22 Mar 2012 15:39:56 -0500 apparmor (2.7.101-0ubuntu1) precise; urgency=low * New upstream release. Fixes: LP: #948147 * debian/lib/apparmor/functions: Update to support the feature directory so that caching will work on kernels that support the feature dir. Patch based on work from John Johansen. LP: #954469 -- Jamie Strandboge Thu, 15 Mar 2012 15:57:02 -0500 apparmor (2.7.100-0ubuntu1) precise; urgency=low * New upstream bug fix release which fixes (in addition to other bugs): - LP: #940362 - LP: #947617 - LP: #949891 * Drop the following patches, included upstream: - 0004-lp918879.patch - 0007-lp941506.patch - 0008-lp941503.patch - 0009-lp943161.patch * Drop the following patch, no longer required: - 0005-disable-minimization.patch * Rename 0006-lp941808.patch 0004-lp941808.patch * debian/patches/0001-add-chromium-browser.patch: update for additional denials with newer chromium-browser. (LP: #937723) * debian/put-all-profiles-in-complain-mode.sh: deal with existing flags -- Jamie Strandboge Fri, 09 Mar 2012 06:56:48 -0600 apparmor (2.7.99-0ubuntu4) precise; urgency=low * Restore dpkg-maintscript-helper changes from 2.7.0-0ubuntu6, lost in 2.7.99-0ubuntu1. -- Colin Watson Mon, 05 Mar 2012 16:11:01 +0000 apparmor (2.7.99-0ubuntu3) precise; urgency=low * debian/patches/0009-lp943161.patch: update to not fail when default-jre-headless is installed (LP: #945019) -- Jamie Strandboge Fri, 02 Mar 2012 12:47:03 -0600 apparmor (2.7.99-0ubuntu2) precise; urgency=low * debian/control: dh-apparmor should Breaks/Replaces on debhelper 9.20120115ubuntu3, not 9.20120115ubuntu2 * debian/patches/0006-lp941808.patch: allow writes to /{,var/}run/sendsigs.omit.d/*dnsmasq.pid for network manager integration (LP: #941808) * debian/patches/0007-lp941506.patch: allow reads to ~/.drirc in the X abstraction (LP: #941506) * debian/patches/0008-lp941503.patch: allow read access to /usr/share/texmf/fonts in fonts abstraction (LP: #941503) * debian/patches/0009-lp943161.patch: fix path to java in ubuntu-browsers.d/java (LP: #943161) -- Jamie Strandboge Fri, 02 Mar 2012 07:50:50 -0600 apparmor (2.7.99-0ubuntu1) precise; urgency=low * New upstream release which also pulls in 2.7.0-1 changes from Debian. For the sake of simplicity, I have added the 2.7.0-1 changelog entry after 2.7.0-0ubuntu7 even though chronologically it appeared in Debian between 2.7.0-0ubuntu4 and 2.7.0-0ubuntu5. - LP: #940422 (FFe) * Drop the following patches, included upstream: - 0003-commits-through-r1882.patch - 0004-lp887992.patch - 0005-lp884748.patch - 0006-lp870992.patch - 0007-lp860856.patch - 0008-lp852062.patch - 0009-lp851977.patch - 0010-lp890894.patch - 0011-lp817956.patch - 0012-lp458922.patch - 0013-lp769148.patch - 0014-lp904548.patch - 0015-lp712584.patch - 0016-lp562831.patch - 0017-lp662906.patch - 0018-deny-home-pki-so.patch - 0019-lp899963.patch - 0020-lp912754a.patch - 0021-lp912754b.patch - 0022-workaround-lp851986.patch - 0023-syslog-ng-needs-dac-read-search.patch - 0024-fix-python-and-ruby-autogeneration.patch - 0025-lp914184.patch - 0026-lp914190.patch - 0027-lp914386.patch - 0028-testsuite-fixes.patch - 0029-lp917628.patch - 0030-lp916285.patch - 0031-lp917639.patch - 0032-lp917641.patch - 0033-add-ubuntu-helpers-to-plugins-common.patch - 0034-lp917859.patch - 0035-kde-should-use-kde4.patch - 0036-lp929531.patch - 0036-fix-manpage-errors.patch * Rename 0037-add-aa-easyprof.patch 0003-add-aa-easyprof.patch * debian/apparmor-profiles.postrm: clean out autogenerated files created by apparmor-profiles.postinst (Closes: 656451) * debian/patches/0004-lp918879.patch: allow /etc/drirc in the X abstraction (LP: #918879) * debian/patches/0005-disable-minimization.patch: do to LP: 940362, minimization is not working correctly. Disable it for now. -- Jamie Strandboge Fri, 24 Feb 2012 09:04:45 -0600 apparmor (2.7.0-1) unstable; urgency=low * debian/po/pt.po add new Portuguese translation, thanks to Pedro Ribeiro, (Closes: 651434). * debian/control: do not require initramfs-tools on !linux-any (Closes: 651297). * debian/{control,rules,debhelper/*}: move dh_apparmor into separate binary package, out of debhelper (Closes: 649784). * debian/{control,rules}: fix up lack of real build-indep. * debian/patches/0036-fix-manpage-errors.patch: minor man page cleanups. * merge changes from Ubuntu (r1443). -- Kees Cook Thu, 09 Feb 2012 15:24:08 -0800 apparmor (2.7.0-0ubuntu7) precise; urgency=low * debian/patches/0037-add-aa-easyprof.patch: add the aa-easyprof tool * apparmor-utils.dirs, apparmor-utils.install, apparmor-utils.manpages: install aa-easyprof and supporting files * python-libapparmor.install: only install LibAppArmor* * debian/rules: use dh_python2 with apparmor-utils * debian/control: apparmor-utils should Depends on ${python:Depends} -- Jamie Strandboge Wed, 15 Feb 2012 07:40:38 -0600 apparmor (2.7.0-0ubuntu6) precise; urgency=low * debian/apparmor.{preinst,postinst,postrm,maintscript}, debian/control: Use maintscript support in dh_installdeb rather than writing out dpkg-maintscript-helper commands by hand. We now simply Pre-Depend on a new enough version of dpkg rather than using 'dpkg-maintscript-helper supports' guards, leading to more predictable behaviour on upgrades. -- Colin Watson Sat, 11 Feb 2012 15:11:01 +0000 apparmor (2.7.0-0ubuntu5) precise; urgency=low * debian/patches/0036-lp929531.patch: adjust base abstraction to allow read access to /sys/devices/system/cpu/online (LP: #929531) -- Jamie Strandboge Thu, 09 Feb 2012 08:04:13 -0600 apparmor (2.7.0-0ubuntu4) precise; urgency=low * debian/patches/0034-lp917859.patch: adjust aspell abstraction for user customizable dictionaries (LP: #917859) * debian/patches/0035-kde-should-use-kde4.patch: adjust abstractions to use kde{,4} instead of kde * debian/control: update Vcs-Bzr -- Jamie Strandboge Wed, 18 Jan 2012 16:27:30 -0600 apparmor (2.7.0-0ubuntu3) precise; urgency=low * debian/patches/0029-lp917628.patch: Adjust dnsmasq profile for NetworkManager integration (LP: #917628) * debian/patches/0030-lp916285.patch: update ubuntu-browsers.d/text-editors to work with emacs2[2-9] (LP: #916285) * debian/patches/0031-lp917639.patch: update p11-kit to allow mmap of libraries in pkcs directories (LP: #917639) * debian/patches/0032-lp917641.patch: ubuntu-integration abstraction for multiarch with gst-plugin-scanner (LP: #917641) * debian/patches/0033-add-ubuntu-helpers-to-plugins-common.patch: include ubuntu-helpers in the plugins-common abstraction -- Jamie Strandboge Tue, 17 Jan 2012 07:18:34 -0600 apparmor (2.7.0-0ubuntu2) precise; urgency=low * debian/patches/0022-workaround-lp851986.patch: update sanitized_helper to include inet6 -- Jamie Strandboge Fri, 13 Jan 2012 11:21:30 +0100 apparmor (2.7.0-0ubuntu1) precise; urgency=low * New upstream release. Fixes the following: - LP: #794974 - LP: #815883 - LP: #840973 * Drop the following patches, included upstream: - af_names-generation.patch - 0004-adjust-logprof-log-search-order.patch - 0005-lp826914.patch - 0006-lp838275.patch - 0007-fix-introspection-tests.patch * Rename 0003-add-debian-integration-to-lighttpd.patch to 0002 * debian/patches/0003-commits-through-r1882.patch: several bug, documentation and performance fixes on our road to AppArmor 2.8 (LP: #840734, LP: #905412) * debian/patches/0004-lp887992.patch: cups-client abstraction should allow owner read of @{HOME}/.cups/client.conf and @{HOME}/.cups/lpoptions (LP: #887992) * update debian/patches/0001-add-chromium-browser.patch for deeper directories of /sys/devices/pci (LP: #885833) * debian/patches/0005-lp884748.patch: allow kate as text editor in the browsers abstraction (LP: #884748) * debian/patches/0006-lp870992.patch: abstractions/fonts should allow access to ~/.fonts.conf.d (LP: #870992) * debian/patches/0007-lp860856.patch: allow read access to sitecustomize.py in the python abstraction, which is needed for apport hooks to work in python applications (LP: #860856) * debian/patches/0008-lp852062.patch: update binaries for transmission clients (LP: #852062) * debian/patches/0009-lp851977.patch: allow ixr access to exo-open for Xubuntu and friends (LP: #851977) * debian/patches/0010-lp890894.patch: allow access to Thunar as well as thunar in ubuntu-integration abstraction (LP: #890894) * debian/patches/0011-lp817956.patch: update usr.sbin.sshd example profile (LP: #817956) * debian/patches/0012-lp458922.patch: update dovecot deliver profile to access various .conf files for dovecot (LP: #458922) * debian/patches/0013-lp769148.patch: allow avahi to do dbus introspection (LP: #769148) * debian/patches/0014-lp904548.patch: fix typo for multiarch line for gconv (LP: #904548) * debian/patches/0015-lp712584.patch: Nvidia users need access to /dev/nvidia* files for various plugins to work right. Since these are all focused around multimedia, add the acceses to the multimedia abstraction. (LP: #712584) * debian/patches/0016-lp562831.patch: allow fireclam plugin to work (LP: #562831) * debian/patches/0017-lp662906.patch: allow software-center in the ubuntu integration browser abstraction (LP: #662906) * debian/patches/0018-deny-home-pki-so.patch: update private-files abstraction to deny write and link to ~/.pki/nssdb/*so files (LP: #911847) * debian/patches/0019-lp899963.patch: add audacity to the ubuntu-media-players abstraction (LP: #899963) * debian/patches/0020-lp912754a.patch,0021-lp912754b.patch: add p11-kit abstraction and add it to the authentication abstraction (LP: #912754) * debian/patches/0022-workaround-lp851986.patch: instead of using Ux in the ubuntu and launchpad abstractions, use a helper child profile. This will help work around the lack of environment filtering (LP: #851986) * debian/patches/0023-syslog-ng-needs-dac-read-search.patch: adjust syslog-ng profile for dac_read_search * debian/patches/0024-fix-python-and-ruby-autogeneration.patch: fix python and ruby autogeneration when using aa-autodep and aa-genprof * debian/patches/0025-lp914184.patch: allow the creation of enchant .config directory in the enchant abstraction (LP: #914184) * debian/patches/0026-lp914190.patch: block write access to ~/.kde/env because KDE automatically sources scripts in that folder on startup (LP: #914190) * debian/pathes/0027-lp914386.patch: add xdg-desktop abstraction and adjust gnome and kde abstractions to use it (LP: #914386) * debian/patches/0028-testsuite-fixes.patch: testsuite fixes in the kernel regression tests -- Jamie Strandboge Thu, 12 Jan 2012 12:55:17 +0100 apparmor (2.7.0~beta1+bzr1774-1ubuntu3) precise; urgency=low * Rebuild for Perl 5.14. -- Colin Watson Tue, 15 Nov 2011 22:10:05 +0000 apparmor (2.7.0~beta1+bzr1774-1ubuntu2) oneiric; urgency=low * 0007-fix-introspection-tests.patch: Add missing introspection regression test that should have been checked in with the introspection patches. -- Jamie Strandboge Tue, 04 Oct 2011 13:13:05 -0500 apparmor (2.7.0~beta1+bzr1774-1ubuntu1) oneiric; urgency=low * 0004-adjust-logprof-log-search-order.patch: Adjust the search order to use just /var/log/audit/audit.log and /var/log/syslog. (LP: #835838) * 0005-lp826914.patch: fix missing multiarch in abstraction/X (LP: #826914) * 0006-lp838275.patch: adjust ubuntu-email abstraction for thunderbird 7 (LP: #838275) -- Jamie Strandboge Fri, 02 Sep 2011 12:30:10 -0500 apparmor (2.7.0~beta1+bzr1774-1) unstable; urgency=low * New upstream devel snapshot: - drop 0002-lp750381.patch, taken upstream. - drop 0004-lp754889.patch, taken upstream. - drop 0005-lp761217.patch, taken upstream. - drop 0100-manpage-typo.patch, taken upstream. - drop 0101-declarations.patch, solved differently upstream. - drop 0102-manpage-release-name.patch, taken upstream. - drop 0103-kfreebsd-compile.patch, taken upstream. - drop define-path-max.patch, taken upstream. - drop indep-build.patch, taken upstream. - debian/libapparmor1.manpages: add new function man pages. * Merge with Ubuntu: - drop 0104-python-aa-status.patch, taken upstream. - drop 0105-lightdm.patch, taken upstream. - drop 0106-lp810270.patch, taken upstream. - drop 0107-lp767308.patch, taken upstream. - drop 0108-gnome-mimeinfo.patch, taken upstream. - drop 0109-add-profile-repo-info.patch, taken upstream. * Add af_names-generation.patch to allow arbitrary socket.h file location. -- Kees Cook Wed, 10 Aug 2011 18:12:34 -0700 apparmor (2.6.1-4ubuntu5) oneiric; urgency=low * debian/patches/0109-add-profile-repo-info.patch: add a blurb about the new profiles repository to aa-genprof, along with a link to the wiki page. -- Marc Deslauriers Mon, 18 Jul 2011 10:49:13 -0400 apparmor (2.6.1-4ubuntu4) oneiric; urgency=low * debian/patches/0106-lp810270.patch: updated to use upstream commits -- Jamie Strandboge Fri, 15 Jul 2011 14:08:38 -0500 apparmor (2.6.1-4ubuntu3) oneiric; urgency=low * debian/patches/0106-lp810270.patch: adjustments for /var/run -> /run, /var/lock -> /run/lock and /dev/shm -> /run/shm transition (LP: #810270) * debian/patches/0107-lp767308.patch: allow read access to /usr/local/share/ca-certificates (LP: #767308) * debian/patches/0001-add-chromium-browser.patch: updates for newer chromium (LP: #776648) * debian/patches/0108-gnome-mimeinfo.patch: allow read access to /usr/share/gnome/applications/mimeinfo.cache in the gnome abstraction -- Jamie Strandboge Thu, 14 Jul 2011 09:39:49 -0500 apparmor (2.6.1-4ubuntu2) oneiric; urgency=low * debian/patches/0105-lightdm.patch: allow owner read access to /var/run/lightdm/authority/[0-9]* -- Jamie Strandboge Wed, 22 Jun 2011 16:29:11 -0500 apparmor (2.6.1-4ubuntu1) oneiric; urgency=low * Get rid of Perl in main AppArmor package so we can remove perl-modules from the installation cd: - debian/patches/0104-python-aa-status.patch: switch aa-status to Python - debian/apparmor.*, debian/apparmor-utils.*: move aa-status, symlink and manpages to main apparmor package. - debian/control: add appropriate Breaks/Replaces/Depends because of the file move, add ${python:Depends} to apparmor Depends, add apparmor-utils to apparmor Suggests. - debian/rules: add apparmor package to dh_python2. * debian/lib/apparmor/functions: fix hat separator (LP: #788616) - Based on upstream revision 1733 -- Marc Deslauriers Wed, 01 Jun 2011 11:03:20 -0400 apparmor (2.6.1-4) unstable; urgency=low * debian/po: add new translations: - zh_CN.po: Simplified Chinese, thanks to Aron Xu (Closes: 624853). - da.po: Danish, thanks to Joe Dalton (Closes: 625252). - sv.po: Swedish, thanks to Martin Bagge (Closes: 625264). - cs.po: Czech, thanks to Michal Šimůnek (Closes: 625465). - de.po: German, thanks to Chris Leick (Closes: 625931). - nl.po: Dutch, thanks to Jeroen Schot (Closes: 626269). - ja.po: Japanese, thanks to Hideki Yamane (Closes: 626803). - it.po: Italian, thanks to Dario Santamaria (Closes: 626836). - fr.po: French, thanks to Julien Patriarca (Closes: 626903). - es.po: Spanish, thanks to Francisco Javier Cuadrado (Closes: 627031). * debian/patches/define-path-max.patch: fix Hurd FTBFS. * debian/patches/indep-build.patch: allow split indep/arch builds. * debian/{control,rules,non-linux}: add fake parser for non-Linux builds so that apparmor-utils is installable (Closes: 625977). -- Kees Cook Fri, 27 May 2011 13:51:18 -0700 apparmor (2.6.1-3) unstable; urgency=low * debian/control: add sneaky missing Build-Dep on liblocale-gettext-perl (fixes FTBFS on some extremely minimal chroots, Closes: 624566). * debian/patches/0101-declarations.patch: add missing declarations needed for sensitive compilers (fixes FTBFS on mips/mipsel). * debian/patches/0102-manpage-release-name.patch: update manpage release names to match others. * debian/patches/0103-kfreebsd-compile.patch, debian/{control,rules}: attempt to build as much as possible (no parser) on non-Linux systems. * debian/po/ru.po: add translation, thanks to Yuri Kozlov (Closes: 624741). -- Kees Cook Sun, 01 May 2011 19:29:07 -0700 apparmor (2.6.1-2) unstable; urgency=low * debian/copyright: clarify for some full organization names. -- Kees Cook Wed, 27 Apr 2011 10:38:07 -0700 apparmor (2.6.1-1) unstable; urgency=low * Initial Debian upload (Closes: 622922). * debian/patches/0100-manpage-typo.patch: fix lintian error in manpage. * debian/clean: update for Debian build. * debian/copyright: rearrange and add a few missing files. * debian/source/format, debian/rules: convert to 3.0 quilt format. * debian/{rules,apparmor-profiles.postinst}: deal with lack of dh_apparmor. -- Kees Cook Sat, 23 Apr 2011 12:14:55 -0700 apparmor (2.6.1-0ubuntu3) natty; urgency=low * debian/patches/0003-add-debian-integration-to-lighttpd.patch: updates for lighttpd example profile to work in Debian/Ubuntu (LP: #582814) * debian/patches/0004-lp754889.patch: add several image viewers to ubuntu-browsers.d/multimedia abstraction (LP: #754889) * debian/patches/0005-lp761217.patch: abstractions/private-files updates for zsh and several other shells (LP: #761217) * debian/patches/0001-add-chromium-browser.patch: fixes for multiarch and crash reporter (LP: #764786) -- Jamie Strandboge Mon, 18 Apr 2011 09:23:50 -0500 apparmor (2.6.1-0ubuntu2) natty; urgency=low * debian/patches/0002-lp750381.path: adjust ubuntu-media-players abstraction to allow reading of configs required by gnash and owner writing of @{HOME}/.gnash (LP: #750381) -- Jamie Strandboge Thu, 07 Apr 2011 10:09:24 -0500 apparmor (2.6.1-0ubuntu1) natty; urgency=low * New upstream release. - Fixes breakage of mod_apparmor apache2 module (LP: #737074) - Fixes profile matching when an attachement doesn't contain a regex (LP: #731155) - Fixes parser acceptance of missing network protocols (LP: #732837) - Patches taken upstream and dropped: + debian/patches/0002-lp727478.patch + debian/patches/0003-test-lp727478.patch + debian/patches/0004-lp736870.patch * debian/apparmor.install, debian/apparmor.dirs: add new multiarch tunable file and directory * debian/python-libapparmor.install: loosen directory specification for resiliancy against different python versions -- Steve Beattie Thu, 24 Mar 2011 01:55:12 -0700 apparmor (2.6.0-0ubuntu4) natty; urgency=low * Update debian/patches/0004-lp736870.patch (LP: #736870): - armel triplet doesn't match '*-linux-gnu' - /lib/tls for libc6-xen needs handling - gnome, kde, kerberosclient, and authentication abstractions also need updating for multiarch. -- Steve Langasek Tue, 22 Mar 2011 15:18:54 -0700 apparmor (2.6.0-0ubuntu3) natty; urgency=low * debian/patches/0004-lp736870.patch: add multiarch support to abstractions (LP: #736870) -- Jamie Strandboge Thu, 17 Mar 2011 09:17:01 -0500 apparmor (2.6.0-0ubuntu2) natty; urgency=low * debian/patches/0002-lp727478.patch: Override AF_MAX for kernels that don't support proper masking. Patch thanks to John Johansen (LP: #727478) * debian/patches/0003-test-lp727478.patch: add tcp.sh test as partial networking test -- Jamie Strandboge Thu, 03 Mar 2011 16:40:08 -0600 apparmor (2.6.0-0ubuntu1) natty; urgency=low [ Steve Beattie ] * New upstream 2.6.0 release (LP: #724193) - Patches taken upstream and dropped: + 0001-ubuntu-buildd.patch + 0003-add-libvirt-support-to-dnsmasq.patch + 0004-lp698194.patch + 0005-aa-disable.patch - debian/rules: remove library path settings for mod_apparmor and pam_apprmor builds; upstream handles this properly now. - debian/apparmor-utils.install: handle upstream SubDomain.pm => AppArmor.pm renaming * debian/lib/apparmor/functions: handle profile names with embedded spaces (LP: #655523) * debian/rules, debian/control, debian/python-libapparmor: build a python-libapparmor package. [ Jamie Strandboge ] * debian/copyright: update and reformat according to DEP-5 * debian/lib/apparmor/functions: don't unload dynamically generated libvirt profiles on reload, restart, and force-reload (LP: #702774) * debian/control: use Section: python for python-libapparmor -- Steve Beattie Thu, 24 Feb 2011 01:41:58 -0800 apparmor (2.6~devel+bzr1617-0ubuntu2) natty; urgency=low * debian/patches/0005-aa-disable.patch: add aa-disable * debian/apparmor-utils.install: install aa-disable * debian/apparmor-utils.manpages: install aa-disable man page -- Jamie Strandboge Mon, 07 Feb 2011 11:23:50 -0600 apparmor (2.6~devel+bzr1617-0ubuntu1) natty; urgency=low * Merge with upstream bzr revision 1617. Closes the following bugs: - LP: #692406: temporarily disable the defunct repository until an alternative can be used - LP: #649497: add ibus abstraction - LP: #652562: allow 'rw' to /var/log/samba/cores/ - LP: #658135: allow access to /usr/lib32 and /usr/lib64 for dri modules * 0002-add-chromium-browser.patch: add /dev/shm/.org.chromium.* (LP: #692866) * rename debian/patches/0010-ubuntu-buildd.patch to 0001-ubuntu-buildd.patch and adjust debian/patches/series * debian/patches/0003-add-libvirt-support-to-dnsmasq.patch (LP: #697239): - allow read and write access to libvirt pid files for dnsmasq - allow net_admin capability for DHCP server - allow net_raw and network inet raw for ICMP pings when used as a DHCP server * debian/patches/0004-lp698194 (LP: #698194): - abstractions/private-files: don't allow wl to autostart directories - abstractions/private-files-strict: don't allow access to chromium, kwallet and popular mail clients -- Jamie Strandboge Fri, 07 Jan 2011 12:44:26 -0600 apparmor (2.6~devel+bzr1601-0ubuntu1) natty; urgency=low * Merge with upstream bzr revision 1601 to gain parser speed improvements and man page fixes. Closes the following bugs: - LP: #349049: document audit, deny and owner rule qualifiers - LP: #466228: ubuntu-browsers.d/multimedia: allow flash printing - LP: #644983: add ubuntu-browsers.d/ubuntu-integration-xul - LP: #692216: use aa_change_hat() instead of change_hat() - LP: #692217: add aa_change_profile.pod manpage * debian/control: explicitly depend on gettext module. * ship apparmor vim syntax file (LP: #646800): - debian/vim-apparmor.yaml: vim addon definition file. - debian/apparmor-utils.install: add apparmor.vim and vim-apparmor.yaml. * debian/libapparmor1.manpages: ship aa_change_profile manpage. -- Kees Cook Mon, 20 Dec 2010 14:37:38 -0800 apparmor (2.6~devel+bzr1527-0ubuntu1) natty; urgency=low * Merge with upstream bzr revision 1527, drop patches taken upstream: - debian/patches/0001-fix-release.patch - debian/patches/0003-local-includes.patch - debian/patches/0004-ubuntu-abstractions-updates.patch - debian/patches/0005-lp648900.patch - debian/patches/0006-testsuite-fixes.patch - debian/patches/0007-honor-cflags.patch - debian/patches/0008-lp652674.patch - debian/patches/0009-sensible-browser-pix.patch * Rework packaging for more sanity. - debian/control: - bump debhelper build depend to Ubuntu-specific v8. - switch apparmor-profiles to arch all as it ships only text. - update Homepage to new domain. - expand long descriptions to keep lintian happy. - debian/compat: bump to 8. - README.Debian: removed, hopelessly out of date. - debian/copyright: - updated for changes to upstream source layout. - fixed lintian warnings. - debian/rules: - ditch mv/install in favor of *.install,*.dir files. - replace "dh_clean -k" with "dh_prep" - use dh_clean's debian/clean file instead of manual rm. - scan for all profiles to run through dh_apparmor. - debian/*.{install,dirs,manpages,docs}: - explicitly list all files needed for packaging - debian/apparmor.{preinst,postinst,postrm}: - add dpkg-maintscript-helper calls to clean up old script locations. - drop old conffile cleanups, since they predate Lucid. - debian/apparmor.init: - move functions to /lib/apparmor. - start on $remote_fs due to using /usr tools during init. - use LC_COLLATE=C for proper sorting. - debian/libapparmor1.symbols: created initial symbols file. - debian/apparmor-docs.doc-base: include doc-base details for techdoc. - debian/notify/90apparmor-notify: use new command name. - lib/apparmor/functions: use LC_COLLATE=C for proper sorting. -- Kees Cook Thu, 04 Nov 2010 18:06:34 -0700 apparmor (2.5.1-0ubuntu4) natty; urgency=low * debian/patches/0004-ubuntu-abstractions-updates.patch: updated to add /usr/bin/emacs-snapshot-gtk PUxr * debian/patches/0009-sensible-browser-pix.patch: use Pix for sensible-browser * debian/patches/0010-ubuntu-buildd.patch: skip parser caching test if the AppArmor securityfs introspection directory is not mounted, as is the case on Ubuntu buildds. -- Jamie Strandboge Tue, 02 Nov 2010 12:17:21 -0500 apparmor (2.5.1-0ubuntu3) natty; urgency=low * debian/control: use the correct version for Conflicts/Replaces -- Jamie Strandboge Tue, 19 Oct 2010 19:53:26 -0500 apparmor (2.5.1-0ubuntu2) natty; urgency=low * debian/{rules,control}: move apache2 abstractions into the base package so we can put apache2 profiles into the -profiles package without aa-logprof bailing out. Patch by Marc Deslauriers. (LP: #539441) -- Jamie Strandboge Tue, 19 Oct 2010 15:44:43 -0500 apparmor (2.5.1-0ubuntu1) natty; urgency=low * New upstream release (LP: #660077) - The following patches were refreshed: + 0001-fix-release.patch + 0003-local-includes.patch + 0008-lp648900.patch: renamed as 0005-lp648900.patch - The following patches were dropped (included upstream): + 0005-lp601583.patch + 0006-network-interface-enumeration.patch + 0007-gnome-updates.patch * debian/patches/0006-testsuite-fixes.patch: testsuite fixes from head of 2.5 branch. These are needed for QRT and SRU testing (LP: #652211) * debian/patches/0007-honor-cflags.patch: have the parser makefile honor CFLAGS environment variable. Brings back missing symbols for the retracer * debian/patches/0008-lp652674.patch: fix warnings for messages without denied or requested masks (LP: #652674) * debian/apparmor.init: fix path to aa-status (LP: #654841) * debian/apport/source_apparmor.py: apport hook should use root_command_hook() for running apparmor_status (LP: #655529) * debian/apport/source_apparmor.py: use ProcKernelCmdline and don't clobber cmdline details (LP: #657091) -- Jamie Strandboge Fri, 15 Oct 2010 12:23:00 -0500 apparmor (2.5.1~rc1-0ubuntu2) maverick; urgency=low * abstractions/ubuntu-email: adjustment for ever-changing thunderbird path (LP: #648900) -- Jamie Strandboge Mon, 27 Sep 2010 09:00:06 -0500 apparmor (2.5.1~rc1-0ubuntu1) maverick; urgency=low [ Jamie Strandboge ] * New upstream RC release (revision 1413). In addition to getting the tools to work with the maverick kernel, this update fixes: - LP: #619521 - LP: #633369 - LP: #626451 - LP: #581525 - LP: #623467 (link and unlink still need to be addressed) * Dropped the following patches, included upstream: - 0002-lp615177.patch - 0004-ubuntu-pux.patch - 0006-kde4-config-pux.patch - 0007-lp605835.patch - 0012-lp625041.patch - 0013-lp623586.patch * Update the following patches: - rename 0010-fix-release.patch as 0001-fix-release.patch since this will likely always need to be here - rename 0005-add-chromium-browser.patch as 0002-add-chromium-browser.patch - rename 0001-local-includes.patch as 0003-local-includes.patch and update to use r1493 (from trunk) of local/README file. This can be dropped in 2.6. - collect the ubuntu abstractions updates pulled from trunk into 0004-ubuntu-abstractions-updates.patch. This can be dropped in 2.6. - rename 0008-lp601583.patch as 0005-lp601583.patch. This can be dropped in 2.5.1 final. * fix up some lintian warnings: - debian/control: + don't use 'Section' in apparmor-notify, since it is the same as the source + updates Standards-Version to 3.9.1 + add ${misc:Depends} to libapparmor-dev and apparmor-notify - add debian/source/format - debian/libapache2-mod-apparmor.postrm: use #DEBHELPER# - debian/libapache2-mod-apparmor.preinst: use #DEBHELPER# - add debian/watch * debian/notify/notify.conf: set show_notifications="yes" by default * debian/patches/0006-network-interface-enumeration.patch: allow network interface enumeration. This can be dropped in 2.5.1 final. * debian/patches/0007-gnome-updates.patch: update for font/icon/mime locations in current gnome. This can be dropped in 2.5.1 final. [ Kees Cook ] * debian/apparmor.init: rename "stop" to "teardown", drop caches on "stop" and warn about the dangers of "teardown". -- Jamie Strandboge Fri, 10 Sep 2010 11:07:19 -0500 apparmor (2.5.1~pre1393-0ubuntu6) maverick; urgency=low * debian/profiles/chromium-browser: updated to have the proper path to local/ * debian/patches/0011-lp514356+573344+593413.patch: browser abstraction updates for /net, kmozillahelper and gnome-appearance-properties (LP: #593413, LP: #514356, LP: #573344) * debian/patches/0012-lp625041.patch: add sensible-browser (LP: #625041) * debian/patches/0013-lp623586.patch: allow access to ghostscript fonts when not using defoma (LP: #623586) -- Jamie Strandboge Fri, 03 Sep 2010 07:39:31 -0500 apparmor (2.5.1~pre1393-0ubuntu5) maverick; urgency=low * debian/patches/0007-lp605835.patch: allow ca-certificates in ssl_certs abstraction (LP: #605835) * debian/patches/0008-lp601583.patch: adjust X abstraction for newer gdm (LP: #601583) * debian/patches/0009-lp565753.patch: add ubuntu-feed-readers abstraction and have ubuntu-browsers.d/multimedia use it (LP: #565753) * debian/apparmor.config: don't try to read in the existing value from /etc/apparmor.d/tunables/home.d/ubuntu, but instead always use what is in debconf. (LP: #561694) * add aa-update-browser for giving a programmatic way to update browser profiles to use browser abstractions - add debian/aa-update-browser - add debian/aa-update-browser.8 - debian/rules: install aa-update-browser* * debian/patches/0003-ubuntu-browsers-d.patch: updated to generalize java child profile names * debian/patches/0010-fix-release.patch: update common/Make.rules to use lsb_release -- Jamie Strandboge Wed, 11 Aug 2010 09:24:23 -0500 apparmor (2.5.1~pre1393-0ubuntu4) maverick; urgency=low * debian/patches/0001-local-includes.patch: updated to adjust local/README to have upstream clarifications * debian/patches/0003-ubuntu-browsers-d.patch: add ubuntu-browsers.d/* abstractions * debian/patches/0004-ubuntu-pux.patch: use 'PUx' instead of 'Ux' in abstractions/ubuntu-* * add chromium-browser profile. All this can be removed once chromium-browser ships its own profile: - debian/patches/0005-add-chromium-browser.patch: add preliminary profiles/apparmor.d/usr.bin.chromium-browser - debian/profiles/chromium-browser: added for use with ubuntu-browsers.d - debian/rules: ship debian/profiles/chromium-browser in apparmor-profiles * don't make /etc/apparmor.d/local/* from apparmor-profiles conffiles - debian/control: Build-Depends on debhelper 7.4.20ubuntu5 - debian/rules: use dh_apparmor instead of shipping the files as conffiles - debian/apparmor-profiles.postinst: move DEBHELPER before initscript reload - debian/apparmor-profiles.postrm: added to remove chromium-browser config file * debian/patches/0006-kde4-config-pux.patch: remove kde4-config from kde abstraction and add it to kde ubuntu-browsers abstraction -- Jamie Strandboge Tue, 10 Aug 2010 14:31:32 -0500 apparmor (2.5.1~pre1393-0ubuntu3) maverick; urgency=low * debian/patches/0002-lp615177.patch: 'owner' match in commit 1406 too strict for /tmp/ and /var/tmp/ (LP: #615177) -- Jamie Strandboge Mon, 09 Aug 2010 10:17:05 -0500 apparmor (2.5.1~pre1393-0ubuntu2) maverick; urgency=low * debian/rules: move local/usr.lib.apache2.mpm-prefork.apache2 to libapache2-mod-apparmor -- Jamie Strandboge Fri, 06 Aug 2010 13:38:59 -0500 apparmor (2.5.1~pre1393-0ubuntu1) maverick; urgency=low * Update to upstream bzr revision 1393 from lp:apparmor/2.5. * add dbus-session abstraction (LP: #566207) * require owner in user-tmp abstraction (LP: #578922) * don't use uninitialized $opt_s (LP: #582075) * allow thunderbird 3 in abstractions/ubuntu-email (LP: #590462) * allow gmplayer in abstractions/ubuntu-media-players (LP: #591421) * debian/control: updated branches. * debian/patches/0001-local-includes.patch: backported patch from trunk to allow local administrators to customize their profiles without modifying a shipped profile * debian/rules: - don't pass RELEASE to libapparmor's 'make install' as it breaks the build and isn't used by the Makfile anyway - install apparmor.d/local/README in apparmor, not apparmor-profiles - don't install apparmor.d/local/usr.sbin.ntpd * Drop the following patches already included upstream: - 0001-lp538561.patch - 0002-aalogprof-warnings.patch - 0003-fix-memleaks.patch - 0004-lp549557.patch - 0005-lp538661.patch - 0006-lp611248.patch -- Jamie Strandboge Thu, 05 Aug 2010 16:10:46 -0500 apparmor (2.5-0ubuntu4) maverick; urgency=low * debian/patches/0006-lp611248.patch: allow access to gdk-pixbuf loaders LP: #611248 -- Jamie Strandboge Tue, 03 Aug 2010 09:32:10 -0500 apparmor (2.5-0ubuntu3) lucid; urgency=low [ Jamie Strandboge ] * debian/patches/lp-549557.patch: have apparmor_notify deal with log file rotation. (LP: #549557) * debian/notify/notify.conf: set show_notifications="yes" * debian/patches/0005-lp538661.patch: adjust php5 abstraction for cgi config file path and extensions (LP: #538661) [ Kees Cook ] * debian/apparmor.functions: do not load in parallel, this is causing weird side-effects. -- Jamie Strandboge Tue, 30 Mar 2010 11:31:49 -0500 apparmor (2.5-0ubuntu2) lucid; urgency=low [ Jamie Strandboge ] * debian/patches/0001-lp538561.patch: add 'k' to /var/lib/samba/**.tdb in the samba abstraction (LP: #538561) [ Marc Deslauriers ] * debian/patches/0002-aalogprof-warnings.patch: get rid of warnings when aa-logprof is run. * debian/{rules,control}: move apache2 abstractions into the base package so we can put apache2 profiles into the -profiles package without aa-logprof bailing out. (LP: #539441) * debian/patches/0003-fix-memleaks.patch: include a couple of leak patches from upstream. -- Marc Deslauriers Fri, 26 Mar 2010 11:39:18 -0400 apparmor (2.5-0ubuntu1) lucid; urgency=low * New upstream release. * debian/control: updated branches. * debian/copyright: updated download locations. * debian/rules: drop unneeded build variables. * common/Make.rules: set distributor. -- Kees Cook Thu, 11 Mar 2010 00:08:08 -0800 apparmor (2.5~pre+bzr1367-0ubuntu1) lucid; urgency=low * Update to upstream bzr revision 1367 * debian/notify/90apparmor-notify: sleep for 60 seconds for boot speed and to make sure that X is all the way up so the notifications look pretty -- Jamie Strandboge Mon, 08 Mar 2010 13:53:50 -0600 apparmor (2.5~pre+bzr1364-0ubuntu1) lucid; urgency=low * Update to upstream bzr revision 1364. * debian/apparmor.functions: ignore .dpkg-bak files when loading too. -- Kees Cook Wed, 17 Feb 2010 13:36:21 -0800 apparmor (2.5~pre+bzr1362-0ubuntu2) lucid; urgency=low * debian/apparmor.postinst: on upgrades, prepopulate apparmor/homedirs if it is not preseeded. Will check /etc/passwd for UIDs >= 1000 and < 30000 for unique dirnames of home directories that are not /home. Fully resolves (LP: #447292) -- Jamie Strandboge Wed, 17 Feb 2010 09:42:55 -0600 apparmor (2.5~pre+bzr1362-0ubuntu1) lucid; urgency=low [ Kees Cook ] * Update to upstream bzr revision 1362. - This release includes DFA minimization, transition table compression, and improved partitioning performance (LP: #503869). - drop 0001-tunable-alias.patch, now upstream. * debian/apparmor.postinst: update home.d template to note the trailing slash, even if the debconf template mentions it too. * debian/apparmor.functions: go fully parallel with parsing to use all CPUs in the case of needing to regenerate caches. * debian/rules: enable library testsuite during build. * debian/control: add dejagnu for library testsuite. * debian/{rules,control}: use chrpath to drop rpath in libapparmor-perl. [ Jamie Strandboge ] * debian/control: add apparmor-notify * add debian/notify/notify.conf * add debian/notify/90apparmor-notify * add debian/apparmor-notify.install: install notify.conf to /etc/apparmor and 90apparmor-notify to /etc/X11/Xsession.d * debian/rules: - remove upstream notify.conf since we will install our own via debhelper - move apparmor_notify script and man pages to apparmor-notify -- Kees Cook Sat, 13 Feb 2010 12:19:30 -0800 apparmor (2.3.1+bzr1312-0ubuntu4) lucid; urgency=low * 0001-tunable-alias.patch: backport r1330 to make it easier for people to use AppArmor's alias rules (LP: #160002) -- Jamie Strandboge Mon, 11 Jan 2010 14:31:06 -0600 apparmor (2.3.1+bzr1312-0ubuntu3) lucid; urgency=low * debian/apparmor.{init,functions}: - add "recache" argument to init script for liveCD cache generation. - skip start/stop/reload when running on liveCD. -- Kees Cook Fri, 08 Jan 2010 08:39:14 -0800 apparmor (2.3.1+bzr1312-0ubuntu2) lucid; urgency=low * debian/rules: disable profiling support for released version. -- Kees Cook Wed, 06 Jan 2010 16:57:58 -0800 apparmor (2.3.1+bzr1312-0ubuntu1) lucid; urgency=low [ Kees Cook ] * Update to upstream bzr revision 1312. * debian/apparmor.postrm: fix comment typo. * debain/rules: switch to bzr for upstream versioning. * debian/rules: install apache2-* abstractions into apache2-mod package. * drop debian/patches/0001-likewise-home-tunables.patch: this is causing too much time in the parser (see LP 503869). The default install is suffering, so move this configuration to likewise-open (see LP 274350). [ Jamie Strandboge ] * debian/rules: - don't ship tunables/home.d/site.local - correct path for moving apache2 abstraction * add debconf question for adjusting HOMEDIRS (LP: #447292) - add debian/apparmor.config - debian/apparmor.postinst: query debconf and adjust tunables/home.d/ubuntu - debian/apparmor.postrm: on purge, remove tunables/home.d/ubuntu and run db_purge - debian/control: Build-Depends on po-debconf and have apparmor Depends on debconf - add debian/po/* - debian/rules: use dh_installdebconf -papparmor - added debian/templates -- Kees Cook Wed, 06 Jan 2010 15:51:33 -0800 apparmor (2.3.1+1403-0ubuntu31) lucid; urgency=low * Remove initramfs hooks, as early profile loading is handled on a service-by-service basis with Upstart jobs now. -- Kees Cook Fri, 04 Dec 2009 13:22:04 -0800 apparmor (2.3.1+1403-0ubuntu30) lucid; urgency=low [ Jamie Strandboge ] * convert to using quilt - debian/control: Build-Depends on quilt - add debian/README.source - debian/rules: include /usr/share/quilt/quilt.make and adjust targets for patching * debian/patches/0001-likewise-home-tunables.patch: tunables/home: add /home/likewise-open/*/ to HOMEDIRS (LP: #274350) * Merge to upstream bzr rev 1308. - really add chromium-browser (LP: #488559) - add official google-chrome (LP: #481661) [ Kees Cook ] * parser/parser_main.c: use nanosec ctime resolution when checking cache file times. * parser/tst/caching.sh: add tests for cache use based on timestamps. -- Jamie Strandboge Fri, 04 Dec 2009 11:11:01 -0600 apparmor (2.3.1+1403-0ubuntu29) lucid; urgency=low * parser/Makefile: generate af_names.h based on bits/socket.h since linux/socket.h no longer has what we need (LP: #474751) * usr.sbin.dnsmasq: fully address LP: #445818 - more pidfile refinements - allow access to /var/run/dnsmasq - allow access to /etc/dnsmasq.d - allow dac_override so it can write its pidfile * abstractions/ubuntu-browsers: add chromium-browser -- Jamie Strandboge Wed, 04 Nov 2009 17:07:23 -0600 apparmor (2.3.1+1403-0ubuntu28) lucid; urgency=low [ Jamie Strandboge ] * update skype profile in extras. Based on work by Андрей Калинин. (LP: #226624) * abstractions/ubuntu-browsers: add opera and icecat (LP: #432778) * abstractions/ubuntu-browsers: add epiphany (epiphany-browser and epiphany-webkit were already present, but the recent changes in epiphany packaging require /usr/bin/epiphany) (LP: #472952) * usr.sbin.dnsmasq: allow pidfiles for /var/run/dnsmasq*.pid (LP: #445818) * abstractions/gnome: allow access to ~/.themes (LP: #460125) * abstractions/kde: allow access to /etc/kde4rc and /usr/bin/kde4-config (LP: #447006) [ Marc Deslauriers ] * utils/Subdomain.pm: don't skip reading profiles that are also in the cache directory (LP: #446449) * utils/Subdomain.pm: correctly parse PUxr modes * utils/Subdomain.pm: support include directories -- Jamie Strandboge Wed, 04 Nov 2009 11:02:27 -0600 apparmor (2.3.1+1403-0ubuntu27) karmic; urgency=low * utils/SubDomain.pm: handle new format "null" log entries (LP: #446524) -- Marc Deslauriers Fri, 16 Oct 2009 14:40:04 -0400 apparmor (2.3.1+1403-0ubuntu26) karmic; urgency=low * abstractions/ubuntu-browsers: add Dooble * abstractions/ubuntu-browsers: add chromium (LP: #448812) * abstractions/gnome: add read for /etc/orbitrc * abstractions/audio: add read for /etc/pulse/* for when ~/.pulse/* doesn't exist and these files are used for fallback -- Jamie Strandboge Wed, 14 Oct 2009 07:59:03 -0500 apparmor (2.3.1+1403-0ubuntu25) karmic; urgency=low * Do not use tools in /usr during initial start-up (LP: #439726). -- Kees Cook Fri, 02 Oct 2009 16:52:04 -0700 apparmor (2.3.1+1403-0ubuntu24) karmic; urgency=low * abstractions/X: allow mouse themes (LP: #438051) -- Jamie Strandboge Thu, 01 Oct 2009 16:07:25 -0500 apparmor (2.3.1+1403-0ubuntu23) karmic; urgency=low [ Kees Cook ] * Really fix quiet mode in initramfs (LP: #435285). * Handle older kernel versions when loading profiles (LP: #429872): - parser/parser_{interface,main}.c: detect kernel version and downgrade. - debian/apparmor.functions, parser/parser_main.c: keep kernel features recorded in cache directory. - parser/parser_{interface,main}.c: add --skip-kernel-load for testing. - parser/tst/caching.*: add caching tests. [ Jamie Strandboge ] * abstractions/audio: add a few more files for pulseaudio -- Kees Cook Fri, 25 Sep 2009 09:54:01 -0700 apparmor (2.3.1+1403-0ubuntu22) karmic; urgency=low * Do not run AppArmor on the LiveCD, again (LP: #131976). * More aggressively stay quiet when booting in quiet mode (LP: #435285). -- Kees Cook Wed, 23 Sep 2009 15:40:22 -0700 apparmor (2.3.1+1403-0ubuntu21) karmic; urgency=low * debian/apparmor.{init-bottom,functions,initramfs}: perform initial apparmor rule loading in initramfs. -- Kees Cook Mon, 21 Sep 2009 14:16:26 -0700 apparmor (2.3.1+1403-0ubuntu20) karmic; urgency=low * added disabled apache2 profile (FFE LP: #430812): - add profiles/apparmor.d/usr.lib.apache2.mpm-prefork.apache2: new apache2 profile - add profiles/apparmor.d/apache2.d/phpsysinfo: example profile for the phpsysinfo application - profiles/Makefile: handle the apache2.d directory - add debian/libapache2-mod-apparmor.postinst: reload apparmor after installation since we now ship a profile in this package - add debian/libapache2-mod-apparmor.preinst: disable apache2 profile if the user does not already have a profile defined - add debian/libapache2-mod-apparmor.postrm: remove disabled symlink on purge - debian/rules: move apache2 profile to the libapache2-mod-apparmor package and create apache2.d directory * utils/SubDomain.pm: handle "open" log entries (LP: #427966) * added ouid parsing support (LP: #431929): - libraries/libapparmor/testsuite/test_multi.c - libraries/libapparmor/src/{scanner.l,grammar.y,aalogparse.h, libaalogparse.c} -- Marc Deslauriers Sat, 19 Sep 2009 09:32:02 -0400 apparmor (2.3.1+1403-0ubuntu19) karmic; urgency=low [ Jamie Strandboge ] * abstractions/fonts: allow links in @{HOME}/.fontconfig/** [ Kees Cook ] * debian/apparmor.init: expect that the securityfs is mounted, and only test for the mounted filesystem against the type column when it is not found. -- Kees Cook Wed, 09 Sep 2009 11:42:07 -0700 apparmor (2.3.1+1403-0ubuntu18) karmic; urgency=low * added the following abstractions: - ubuntu-browsers: Ux transitions to graphical browsers - ubuntu-console-browsers: Ux transitions to text-mode browsers - ubuntu-console-email: Ux transitions to text-mode email clients - ubuntu-email: Ux transitions to graphical email clients - ubuntu-gnome-terminal: ix transition for gnome-terminal - ubuntu-konsole: ix transition for konsole - ubuntu-xterm: ix transition for xterm -- Jamie Strandboge Thu, 03 Sep 2009 11:57:39 -0500 apparmor (2.3.1+1403-0ubuntu17) karmic; urgency=low * abstractions/base: workaround for ecryptfs and apparmor by allowing 'owner' match for files in .Private. (LP: #359338) -- Jamie Strandboge Mon, 31 Aug 2009 15:38:54 -0500 apparmor (2.3.1+1403-0ubuntu16) karmic; urgency=low * profiles/apparmor.d/*dovecot*: add first-pass at complain-only profiles for basic dovecot operation. -- Kees Cook Wed, 26 Aug 2009 15:19:46 -0700 apparmor (2.3.1+1403-0ubuntu15) karmic; urgency=low * utils/SubDomain.pm: don't abort when an include file only contains hats (LP: #400367) -- Marc Deslauriers Wed, 26 Aug 2009 11:35:58 -0400 apparmor (2.3.1+1403-0ubuntu14) karmic; urgency=low * Pull upstream changes for 64bit capabilities (svn 1427, 1437, 1438). * Pull upstream changes for pux exec mode (svn 1439). * debian/apparmor.init: "find" -name is not brace-aware (LP: #418364). -- Kees Cook Mon, 24 Aug 2009 18:01:05 -0700 apparmor (2.3.1+1403-0ubuntu13) karmic; urgency=low [ Kees Cook ] * parser/parser_main.c: add --skip-read-cache to force reading of uncached profiles while still allowing for --write-cache to work. * parser/apparmor_parser.pod: add all missing option documentation. [ Jamie Strandboge ] * abstractions/kde: update for kde4 -- Jamie Strandboge Wed, 19 Aug 2009 12:07:06 -0500 apparmor (2.3.1+1403-0ubuntu12) karmic; urgency=low * abstractions/base: add more locale paths (LP: #413454) -- Jamie Strandboge Fri, 14 Aug 2009 07:31:03 -0500 apparmor (2.3.1+1403-0ubuntu11) karmic; urgency=low * utils/enforce: remove /etc/apparmor.d/disable/ symlink LP: #413153 * debian/rules: don't install usr.sbin.ntpd or tunables/ntpd. Can remove this when we create a new orig.tar.gz -- Jamie Strandboge Wed, 12 Aug 2009 10:04:34 -0500 apparmor (2.3.1+1403-0ubuntu10) karmic; urgency=low * remove apparmor.d/usr.sbin.ntpd and apparmor.d/tunables/ntpd since ntpd will begin shipping its own profile -- Jamie Strandboge Wed, 12 Aug 2009 10:02:53 -0500 apparmor (2.3.1+1403-0ubuntu9) karmic; urgency=low * Revert 64-bit capabilities (LP: #408773). -- Kees Cook Tue, 04 Aug 2009 11:51:27 +0100 apparmor (2.3.1+1403-0ubuntu8) karmic; urgency=low * Update to upstream subversion r1431. - change_profile can use regex (LP: #390810, #401931) * debian/apparmor.init: always clear cache on reload. -- Kees Cook Mon, 03 Aug 2009 07:46:33 -0700 apparmor (2.3.1+1403-0ubuntu7) karmic; urgency=low * profiles/apparmor.d/abstractions/base: add /proc/sys/crypto (LP: #392337). -- Kees Cook Sat, 25 Jul 2009 09:04:46 -0700 apparmor (2.3.1+1403-0ubuntu6) karmic; urgency=low [ Kees Cook ] * parser/parser_policy.c: return errors instead of exiting. * debian/apparmor.init: skip more suffixes. * parser/parser_lex.l: define file suffixes to ignore. * parser/parser_main.c: disable cache for parsing reports. * debian/apparmor.init: also remove unparsed profiles. [ Jamie Strandboge ] * update gnome abstraction for /var/run/gdm/auth*/database * utils/SubDomain.pm: parse profiles in subdirectories, not just include files (LP: #401935) -- Jamie Strandboge Mon, 20 Jul 2009 11:45:24 -0500 apparmor (2.3.1+1403-0ubuntu5) karmic; urgency=low * Always use --replace when loading profiles so that if profiles are loaded outside of the init script (e.g. dhcp3), the init script does not abort (LP: #401109). * parser/parser_main.c: more carefully create cache files. -- Kees Cook Sun, 19 Jul 2009 07:48:11 -0700 apparmor (2.3.1+1403-0ubuntu4) karmic; urgency=low * utils/SubDomain.pm: exclude new cache directory. * parser/parser_main.c: - allow OPTION_REMOVE to work again (LP: #400781). - warn about using stdin. - do not cache disabled profiles. - report cached loading if not quiet. * debian/apparmor.init: - do not depend on aa-status. - only write cache from init script. -- Kees Cook Fri, 17 Jul 2009 10:10:05 -0700 apparmor (2.3.1+1403-0ubuntu3) karmic; urgency=low * debian/apparmor.init: more cleanly handle disabled AppArmor. -- Kees Cook Fri, 17 Jul 2009 00:12:19 -0700 apparmor (2.3.1+1403-0ubuntu2) karmic; urgency=low * improve profile loading speed (LP: #382944): - parser/parser_lex.l: move include handling into flex parser. - parser/parser_main.c: - move disable/complain logic into loader. - add binary caching. - debian/apparmor.init: reduce to bare minimum. -- Kees Cook Wed, 15 Jul 2009 17:05:49 -0700 apparmor (2.3.1+1403-0ubuntu1) karmic; urgency=low [ Kees Cook ] * New upstream bundle (svn1403). * debian/apparmor.init: add specific Start/Stop dependencies (LP: #372441). * debian/control: correctly use lsb-base not sysv for Depends. [ Jamie Strandboge ] * add abstractions/launchpad-integration * abstractions/audio: add pulseaudio * add abstractions/private-files* for explicitly denying access to sensitive files. -- Kees Cook Fri, 10 Jul 2009 08:37:54 -0700 apparmor (2.3+1289-0ubuntu15) karmic; urgency=low * Depend on upstart 0.6.0 which contains upstart-compat-sysv now -- Scott James Remnant Fri, 10 Jul 2009 10:28:45 +0100 apparmor (2.3+1289-0ubuntu14) jaunty; urgency=low * abstractions/smbpass: Add *.ldb used in Samba 3.2 and above (LP: #357581) -- Thierry Carrez Wed, 08 Apr 2009 13:42:21 +0200 apparmor (2.3+1289-0ubuntu13) jaunty; urgency=low [ Kees Cook ] * abstractions/gnome: allow /proc/$pid/mounts for gvfs. * abstractions/python: clean up allowed paths (LP: #350820), thanks to Jonathan Davies. [ Jamie Strandboge ] * abstractions/user-tmp: allow 'k' for files in tmp dirs (LP: #351275) -- Jamie Strandboge Tue, 31 Mar 2009 09:57:57 -0500 apparmor (2.3+1289-0ubuntu12) jaunty; urgency=low * expand allowed library paths to handle unexpected architectures (LP: #349819). -- Kees Cook Fri, 27 Mar 2009 13:48:11 -0700 apparmor (2.3+1289-0ubuntu11) jaunty; urgency=low * fix path to winbindd_privileged/pipe in winbind abstraction (LP: #348541) -- Jamie Strandboge Fri, 27 Mar 2009 08:29:13 -0500 apparmor (2.3+1289-0ubuntu10) jaunty; urgency=low * utils/SubDomain.pm: - teach utils about rearranged syslog audit messages (LP: #340183) from upstream commit https://forgesvn1.novell.com/viewsvn/apparmor?view=rev&revision=1393 - fix corruption of profiles, from upstream commit https://forgesvn1.novell.com/viewsvn/apparmor?view=rev&revision=1354 - don't ask about networking events over and over again, from upstream commit https://forgesvn1.novell.com/viewsvn/apparmor?view=rev&revision=1296 - use apparmor logdir instead of /tmp to write debugging log -- Steve Beattie Thu, 19 Mar 2009 03:05:07 -0700 apparmor (2.3+1289-0ubuntu9) jaunty; urgency=low [ Kees Cook ] * abstractions/base: allow /proc/$pid/maps (LP: #343287). * abstractions/*: clean up lib, lib32, lib64 semantics (LP: #342200). * abstractions/nameservice: fix up paths for nscd (LP: #342198). * parser/rc.apparmor.functions, debian/apparmor.init: LSB-ify startup messages (LP: #295200). [ Steve Beattie ] * libapparmor/src/scanner.l: adjust lexer to fix matching updated audit messages (LP: #340183) from upstream commit https://forgesvn1.novell.com/viewsvn/apparmor?view=rev&revision=1389 * debian/source_apparmor.py: add a per-package apport hook (LP: #342554). -- Kees Cook Wed, 18 Mar 2009 21:18:01 -0700 apparmor (2.3+1289-0ubuntu8) jaunty; urgency=low * abstractions/ssl_keys: allow read access to all of /etc/ssl (LP: #317109) * utils/SubDomain.pm: re-add dropped patch to not process disable/ as include files, and also don't process force-complain/ (LP: #331534) -- Jamie Strandboge Thu, 12 Mar 2009 12:53:08 -0500 apparmor (2.3+1289-0ubuntu7) jaunty; urgency=low * abstractions/dbus: add machine-id * abstractions/audio: add libcanberra paths * abstractions/freedesktop.org: add user-dirs.dirs -- Jamie Strandboge Thu, 12 Feb 2009 11:28:15 -0600 apparmor (2.3+1289-0ubuntu6) jaunty; urgency=low [ Kees Cook ] * abstractions/X: add DRI paths. * parser/Makefile: blacklist AF_PHONET. [ Jamie Strandboge ] * update usr.sbin.smbd profile to write to /var/lib/samba/** and read/write to /var/run/dbus/system_bus_socket (LP: #294802) * abstractions/freedesktop.org: use /usr/share/mime/**, @{HOME}/.icons/, and @{HOME}/.recently-used.xbel* * abstractions/gnome: add gvfs remote-volume-monitors paths and printing files -- Kees Cook Mon, 22 Dec 2008 17:20:10 -0800 apparmor (2.3+1289-0ubuntu5) jaunty; urgency=low * abstractions/nameservice: allow read access to /etc/resolvconf/run/resolv.conf (LP: #286080) * adjust src/grammar.y and src/scanner.l to account for the moved type=NNNN field in 2.6.27 kernels and capture non-matching logfile input instead of printing it to stdout (LP: #271252). Patch thanks to Jesse Michael and Steve Beattie. - https://forgesvn1.novell.com/viewsvn/apparmor?view=rev&revision=1310 * add syslog test cases to testsuite. Patch thanks to Steve Beattie. - https://forgesvn1.novell.com/viewsvn/apparmor?view=rev&revision=1307 - https://forgesvn1.novell.com/viewsvn/apparmor?view=rev&revision=1308 - https://forgesvn1.novell.com/viewsvn/apparmor?view=rev&revision=1309 -- Jamie Strandboge Tue, 21 Oct 2008 09:09:58 -0500 apparmor (2.3+1289-0ubuntu4) intrepid; urgency=low * parser/rc.apparmor.functions: fix typo seen when admin changes the default location of the apparmor.d directory (LP: #280467). * abstractions/{samba,base}: clean up unneeded "m" permissions. * abstractions/perl: add missing default perl paths. -- Kees Cook Wed, 08 Oct 2008 16:42:10 -0700 apparmor (2.3+1289-0ubuntu3) intrepid; urgency=low * add locking permission to /var/log/wtmp abstraction, thanks to Martin Pitt (LP: #253328). * utils/logprof.conf: repository updated for Intrepid (LP: #258818). * profiles/apparmor.d/usr.sbin.nscd: added cache directory (LP: #144383). * parser/rc.apparmor.functions: redirect stderr (LP: #244013). * parser/Makefile: blacklist "AF_ISDN". -- Kees Cook Wed, 30 Jul 2008 09:29:03 -0700 apparmor (2.3+1289-0ubuntu2) intrepid; urgency=low [ Mathias Gug ] * debian/control: - move apparmor-profiles to a suggested package by apparmor. [ Kees Cook ] * debian/control - move libterm-readline-gnu-perl to "suggests". - drop apparmor-modules-source since it no longer exists. -- Kees Cook Wed, 02 Jul 2008 12:35:12 -0700 apparmor (2.3+1289-0ubuntu1) intrepid; urgency=low * Updated to upstream subversion v1289. - new parser requires new AppArmor kernel LSM. * debian/control: - add libapparmor-perl, and associated Depends - bump standards version to 3.7.3.0 (no changes needed) * debian/rules: - adjust "clean" rule to be more effective. -- Kees Cook Sat, 28 Jun 2008 15:38:12 -0700 apparmor (2.1+1075-0ubuntu10) intrepid; urgency=low [ Jamie Strandboge ] * added abstractions/smbpass and #include it in abstractions/authentication to allow access to /var/lib/samba/*.tdb. LP: #217787 [ Mathias Gug ] * update likewise-open authentication abstraction: allow access to privileged pipe (LP: #235646). * Update smbd profile to include access to /var/spool/samba/ (printer sharing) and utmp update (LP: #237066). * Update esound location in audio profile (LP: #229127). Thanks to Adam Mondl. * Add dnsmasq profile (LP: #148590). Thanks to John Dong. -- Mathias Gug Mon, 09 Jun 2008 18:24:09 -0400 apparmor (2.1+1075-0ubuntu9) hardy; urgency=low * parser/rc.apparmor.functions: do not abort if parser is missing, in the case of an unpurged "apparmor" init script running under SELinux. -- Kees Cook Mon, 07 Apr 2008 13:25:06 -0700 apparmor (2.1+1075-0ubuntu8) hardy; urgency=low * Sync bugfixes from upstream 8.04 branch, svn 1161. - documentation updated to reflect AppArmor 2.1 features. - minor profile updates (nscd, ntpd, opera) - util/SubDomain.pm: corrected mask merging and type detection. -- Kees Cook Wed, 02 Apr 2008 15:48:58 -0700 apparmor (2.1+1075-0ubuntu7) hardy; urgency=low * profiles/apparmor.d/abstractions/nameservice: (LP: #207912) - fix ldap path - add nsswitch "db" backend paths -- Kees Cook Thu, 27 Mar 2008 14:19:06 -0700 apparmor (2.1+1075-0ubuntu6) hardy; urgency=low [ Kees Cook ] * utils/SubDomain.pm: - fix up mask parsing to match kernel version (LP: #202920). - fix up syslog parsing regexp to match broken kernels (LP: #202888). * profiles/apparmor.d/abstractions/base: add licenses path for reading. * profiles/apparmor.d/abstractions/freedesktop.org: include /usr/local. * profiles/apparmor.d/usr.sbin.smbd: include print client abstraction. * profiles/apparmor.d/abstractions/nameservice: include missing gai.conf (LP: #202991). [ Jamie Strandboge ] * add Debian Policy compliant way to toggle complain mode (LP: #203137) - parser/rc.apparmor.functions: add '-C' to PARSER_ARGS if force-complain/ exists - utils/enforce: remove symlink in force-complain/ - debian/rules: create /etc/apparmor.d/force-complain -- Kees Cook Mon, 17 Mar 2008 10:28:23 -0700 apparmor (2.1+1075-0ubuntu5) hardy; urgency=low * profiles/apparmor.d/abstractions/python: update shared python locations. * debian/control: adjust Depends to allow sysvinit (LP: #199871). -- Kees Cook Tue, 11 Mar 2008 15:25:11 -0700 apparmor (2.1+1075-0ubuntu4) hardy; urgency=low [ Jamie Strandboge ] * removed usr.sbin.named and usr.sbin.mysqld, as these will be provided be bind9 and mysql-server-5.0, respectively. [ Mathias Gug ] * profiles/apparmor.d/abstractions/ssl_keys: add ssl_keys abstraction, to be used by profiles accessing ssl privates keys. [ Rick Clark ] * added abstraction for likewise-open. -- Mathias Gug Wed, 13 Feb 2008 19:16:12 -0500 apparmor (2.1+1075-0ubuntu3) hardy; urgency=low * profiles/apparmor.d/abstractions/fonts: add missing ~/.fonts.conf * profiles/apparmor.d/sbin.klogd: add newly needed @{PROC}/kallsyms -- Kees Cook Wed, 16 Jan 2008 14:16:18 -0800 apparmor (2.1+1075-0ubuntu2) hardy; urgency=low * utils/apparmor_status: fix module loaded test to handle built-in. -- Kees Cook Thu, 03 Jan 2008 17:24:40 -0800 apparmor (2.1+1075-0ubuntu1) hardy; urgency=low [ Mathias Gug ] * profiles/apparmor.d/abstractions/nameservice: update nameservice abstraction to support nscd setup. [ Kees Cook ] * merge with upstream trunk revision 1075. * debian/{control,apparmor.postrm,apparmor.postinst,apparmor.initramfs}: dropped module hook since module is loaded in kernel automatically now. * debian/rules: tweaked get-orig-source to use defined variables. * debian/copyright: mention "get-orig-source" build rule. * debian/{rules,control,libpam-apparmor.docs}: add libpam-apparmor now that PAM is 0.99. -- Kees Cook Thu, 03 Jan 2008 13:29:31 -0800 apparmor (2.1+993-0ubuntu3) gutsy; urgency=low [ Mathias Gug ] * Add mdns4 resolution to nameservice abstraction. (LP: #148579). * Update syslog-ng profile. (LP: #148708). * Add xen tls libraries to base abstraction. (LP: #150282). * Update cups-client abstraction: add /var/run/cups/cups.sock. (LP: #151269) [ Kees Cook ] * Adjust KDE abstractions for Ubuntu paths (LP: #148309). -- Kees Cook Fri, 12 Oct 2007 12:54:36 -0700 apparmor (2.1+993-0ubuntu2) gutsy; urgency=low [ Mathias Gug ] * debian/control: Set maintainer to Ubuntu Core Developers. * utils/SubDomain.pm, utils/logprog.conf: refactor readprofiledir() to not fail on non-existing profile directory. Fixes LP: #141128. * debian/rules: don't compress profiles in doc/extras/. * utils/SubDomain.pm: Fix regex so that aa-logprof can find audit messages in syslog files. Fixes LP: #140508. * Update usr.sbin.nscd profile. Fixes LP: #144383. [ Kees Cook ] * abstractions/gnupg: drop bad attempt at general-purpose client rule. * abstractions/fonts: adjust for new syntax, add more local fonts paths. * abstractions/nameservice: add mmap permission to some /etc files. -- Kees Cook Tue, 25 Sep 2007 10:23:29 -0700 apparmor (2.1+993-0ubuntu1) gutsy; urgency=low * new merge from upstream: * fixes to support new audit messages sent by the kernel module. * bump in minor library version for libapparmor. * debian/control: Add perl libterm-readkey-perl and librpc-xml-perl dependencies for apparmor-utils. Fixes LP: #139757, LP: #139091. * utils/SubDomain.pm: Re-enable RPC client for remote repositories. * profiles/apparmor.d/sbin.syslogd: update profile. Fixes LP: #140672, LP: #140274. -- Mathias Gug Tue, 18 Sep 2007 11:12:50 -0400 apparmor (2.1+961-0ubuntu5) gutsy; urgency=low * utils/SubDomain.pm, parser/rc.apparmor.functions: skip .dpkg-dist profiles. * debian/rules, debian/apparmor.postinst: fix postinst script failure on upgrades. Fix LP: #139683. -- Mathias Gug Fri, 14 Sep 2007 17:20:01 -0400 apparmor (2.1+961-0ubuntu4) gutsy; urgency=low [ Mathias Gug ] * debian/rules: Fix libapparmor-dev build. * apparmor-profiles: remove gnupg.moved. [ Kees Cook ] * abstractions: adjust gnome for new syntax. * abstractions: adjust aspell to add locking. -- Kees Cook Fri, 14 Sep 2007 09:34:15 -0700 apparmor (2.1+961-0ubuntu3) gutsy; urgency=low [ Mathias Gug ] * Update avahi-daemon profile: add m permission to /etc/password and /etc/group. [ Kees Cook ] * Rename libapparmor1-dev back to libapparmor-dev. -- Kees Cook Thu, 13 Sep 2007 15:44:30 -0700 apparmor (2.1+961-0ubuntu2) gutsy; urgency=low [ Mathias Gug ] * Disable html documentation: Fixes LP: #139091. * parser/Makefile, debian/rules: disable html documentation building. * debian/control: remove latex2html dependency. * profiles/apparmor.d/usr.sbin.avahi-daemon: add sys_chroot capability. Fixes LP: #139092. [ Kees Cook ] * profiles/apparmor.d/abstractions/user-tmp: adjust directory permissions for newly unmasked /tmp handling (LP: #138978). * utils/SubDomain.pm: disable remote repositories until RPC::XML MIR clears (LP: 139091). * utils/*.pod: adjust for Ubuntu paths and "aa-" prefixes (LP: #116647). * Fix upgrades to not unload profiles, which would cause programs to become unconfined: - debian/rules: don't stop apparmor on upgrades. - debian/apparmor.postinst: reload profiles after a configure. -- Kees Cook Wed, 12 Sep 2007 13:14:02 -0700 apparmor (2.1+961-0ubuntu1) gutsy; urgency=low * New upstream version. * Support resolvconf. Fix LP: #132468. * Move package maintainance to bzr: * Apply all patches directly into the tree with dpatch apply-all. * debian/patches/: remove all patches as they are applied inline now. * debian/control, debian/control.modules.in: remove dpatch from Build Depends. * debian/rules: * remove dpatch include. * remove patch and unpatch dependencies * debian/control: * Rename libapparmor-dev to libapparmor1-dev. Add Provides: and Conflict: tags. * Remove universe component in Section tag. * Remove apparmor-utils depends on bsdutils. * Update apparmor-modules Recommends to apparmor-modules-2.1. * utils/: * Add audit man page. * Fix mod_appamor library: remove rpath info. * debian/rules: remove rpath info. * debian/control: add chrpath as a build dependency. * Remove apparmor-modules-source package: * debian/conrol: remove apparmor-modules-source package. * debian/apparmor.postinst, debian/apparmor.preinst, debian/apparmor.prerm: remove error_handler function. * debian/rules: remove error_handler option from dh_installinit. * debian/apparmor-modules-_KVERS_.postinst.modules.in, debian/control.modules.in: remove control and postinst files. -- Mathias Gug Tue, 11 Sep 2007 10:44:56 -0400 apparmor (2.0.1+510.dfsg-0ubuntu25) gutsy; urgency=low * debian/rules: move tunables/ and abstractions/ in apparmor package. Fixes LP: #130114. -- Mathias Gug Mon, 06 Aug 2007 14:40:37 -0400 apparmor (2.0.1+510.dfsg-0ubuntu24) gutsy; urgency=low * Cannot Depend on apparmor-modules-* in apparmor due to germinate issues. Moved to Recommends. -- Kees Cook Mon, 23 Jul 2007 11:08:38 -0700 apparmor (2.0.1+510.dfsg-0ubuntu23) gutsy; urgency=low * debian/control: add explicit Depends on l-u-m apparmor kernel modules. -- Kees Cook Wed, 18 Jul 2007 21:07:03 -0700 apparmor (2.0.1+510.dfsg-0ubuntu22) gutsy; urgency=low * 13-subdomain.pm-skip-files.dpatch: update isSkippable function in SubDomain.pm to skip the same files as rc.apparmor.functions (used by the init script) : .dpkg-old, .dpkg-new and symlinks in disable/ sub-directory. -- Mathias Gug Thu, 12 Jul 2007 06:56:45 -0400 apparmor (2.0.1+510.dfsg-0ubuntu21) gutsy; urgency=low * 07-apparmor-init-script.dpatch, debian/rules: skip profiles that have a link in /etc/apparmor.d/disable. Update rules file : create /etc/apparmor.d/disable. -- Mathias Gug Mon, 09 Jul 2007 11:07:29 -0400 apparmor (2.0.1+510.dfsg-0ubuntu20) gutsy; urgency=low * debian/control - fix typo in XS-Vcs. - adjust apparmor-modules-source to no longer be required and document the fact that the modules come from the linux-ubuntu-modules package now. - add initramfs-tools for loading apparmor modules early. * debian/apparmor.{initramfs,postinst,prerm}, debian/rules: install initramfs hook and update-initramfs for adding armor modules for boot. -- Kees Cook Fri, 06 Jul 2007 03:41:06 -0700 apparmor (2.0.1+510.dfsg-0ubuntu19) gutsy; urgency=low * Update 11-getprocattr-api.dpatch: pass back the correct string pointer so as to not corrupt kernel memory (LP: #123081). * debian/control: add XS-Vcs for bzr branch. -- Kees Cook Tue, 03 Jul 2007 09:07:52 -0700 apparmor (2.0.1+510.dfsg-0ubuntu18) gutsy; urgency=low * 02-profile-abstractions-ubuntu.dpatch: add m permission for all libraries under /usr/lib/**, so that ssl libraries optimized for i686 can be accessed. * 09-profile-usr-sbin-mysqld.dpatch: add m permission to /etc/passwd, /etc/group. * 12-profile-samba.dpatch: add profile for smbd and nmbd daemons from samba. * 99-complain-all-profiles.dpatch: turn complain mode for smbd and nmbd profiles. -- Mathias Gug Fri, 29 Jun 2007 15:19:15 +0200 apparmor (2.0.1+510.dfsg-0ubuntu17) gutsy; urgency=low * Update 11-getprocattr-api.dpatch: match upstream more closely, check for errors. -- Kees Cook Tue, 26 Jun 2007 16:00:08 -0700 apparmor (2.0.1+510.dfsg-0ubuntu16) gutsy; urgency=low * Added 11-getprocattr-api.dpatch: update kernel module for getprocattr API change (LP: #122444). -- Kees Cook Tue, 26 Jun 2007 15:21:54 -0700 apparmor (2.0.1+510.dfsg-0ubuntu15) gutsy; urgency=low * debian/apparmor.init: do not unload apparmor module on stop, since it already defaults to capabilities-compatible fall back and we don't want to lose the started process knowledge of the module for the next load of the parser. * Added 10-namespace-header.dpatch: include namespace_sem extern, since mnt_namespace.h is missing it currently. * Updated 07-apparmor-init-script.dpatch: ignore .dpkg-old profiles. -- Kees Cook Tue, 26 Jun 2007 10:04:54 -0700 apparmor (2.0.1+510.dfsg-0ubuntu14) gutsy; urgency=low * Correct missing libapparmor1 file contents. -- Kees Cook Thu, 21 Jun 2007 08:04:42 -0700 apparmor (2.0.1+510.dfsg-0ubuntu13) gutsy; urgency=low * 02-profile-abstractions-ubuntu.dpatch: add /lib/tls/i686/cmov/lib* to base abstraction to support i686 optimized libraries from libc6-i686 package. * 09-profile-usr-sbin-mysqld.dpatch: * add profile usr.sbin.mysqld * update abstractions/mysql * debian/rules: remove extras/usr.sbin.mysqld. * 99-complain-all-profiles.dpatch: * put mysqld profile in complain mode. * put named profile in complain mode. -- Mathias Gug Wed, 20 Jun 2007 12:12:28 -0400 apparmor (2.0.1+510.dfsg-0ubuntu12) gutsy; urgency=low * Add missing dh_makeshlibs call to rules, fix up libapparmor naming. -- Kees Cook Wed, 20 Jun 2007 09:15:48 -0700 apparmor (2.0.1+510.dfsg-0ubuntu11) gutsy; urgency=low * Packaged libapparmor, libapparmor-dev, and libapache2-mod-apparmor. -- Kees Cook Mon, 18 Jun 2007 18:27:46 -0700 apparmor (2.0.1+510.dfsg-0ubuntu10) gutsy; urgency=low * 02-profile-abstractions-ubuntu.dpatch, 06-profile-usr-sbin-named.dpatch: move /dev/random into abstractions/base. * 06-profile-usr-sbin-named.dpatch: Add sys_chroot capability. * debian/rules: don't package aa-eventd and Reports.pm as they use perl modules not maintained in main. Reports.pm is only used by Yast for now. aa-eventd maintains an sqlite database of audit messages which is used by Reports.pm. If configured (not by default), aa-eventd can also send emails when AppArmor audit messages are emited. * debian/control: Add universe component to Section: header. Needed to make it work with PPA. -- Mathias Gug Fri, 15 Jun 2007 12:47:05 -0400 apparmor (2.0.1+510.dfsg-0ubuntu9) gutsy; urgency=low * 06-profile-usr-sbin-named.dpatch : Generate a new profile for /usr/sbin/named to make it work with bind9. * debian/apparmor.init, 07-apparmor-init-script.dpatch: merge ubuntu changes with the latest version from upstream. * 99-complain-all-profiles.dpatch : put all profiles into complain mode by default. Add a small script (put-all-profiles-in-complain-mode.sh) in debian/ that takes care of automatically setting all profiles into complain mode. This script should be used by the maintainer to set all profiles in complain mode before packaging them. -- Mathias Gug Wed, 6 Jun 2007 13:41:57 -0400 apparmor (2.0.1+510.dfsg-0ubuntu8) gutsy; urgency=low * Start apparmor as early as possible in the boot process : just after mountall in rcS.d. Add preinst script to remove symlinks previously installed in rc*.d/. (LP: #116624). * Sync 04-apparmor-status.dpatch with upstream apparmor_status. The previous patch has been merged in upstream. * Update klogd profile : add /var/run/klogd/klogd.pid and /var/run/klogd/kmsg to the profile. -- Mathias Gug Thu, 31 May 2007 14:26:03 -0400 apparmor (2.0.1+510.dfsg-0ubuntu7) gutsy; urgency=low * 03-profile-usr-sbin-ntpd.dpatch: udpdate profile for ntpd daemon. Add /var/lib/ntp/ntp.drift and /var/log/ntpstats/peerstats* to the profile. * 04-apparmor-status.dpatch: improve apparmor_status script. Report more detailed information. -- Mathias Gug Tue, 29 May 2007 13:05:55 -0400 apparmor (2.0.1+510.dfsg-0ubuntu6) gutsy; urgency=low * 02-profile-abstractions-ubuntu.dpatch: Update abstractions for changes specific to Gnome, Debian, and 32bit on 64bit environments. * debian/control: adjust Recommends to apparmor-modules-source (LP: #113553). * debian/apparmor.init: moved rmmod/modprobe into init script, and dropped alias to avoid confusion and move control of the LSM closer to loading the profiles and work around capability already being loaded in the initrd (LP: #113887). -- Kees Cook Thu, 17 May 2007 20:34:41 -0700 apparmor (2.0.1+510.dfsg-0ubuntu5) gutsy; urgency=low * 01-logger-path.dpatch: Fix path to logger (LP: #112147). -- Kees Cook Thu, 03 May 2007 11:59:34 -0700 apparmor (2.0.1+510.dfsg-0ubuntu4) feisty; urgency=low * debian/control: move apparmor-modules to Recommends to Avoid uninstallable situation when AppArmor modules haven't yet been compiled/installed. -- Kees Cook Wed, 11 Apr 2007 11:39:39 -0700 apparmor (2.0.1+510.dfsg-0ubuntu3) feisty; urgency=low * debian/rules, debian/apparmor.{postinst,prerm}: ignore init script failures so that they don't block package installs/upgrades/uninstalls. -- Kees Cook Wed, 11 Apr 2007 08:52:37 -0700 apparmor (2.0.1+510.dfsg-0ubuntu2) feisty; urgency=low * debian/control: add missing Depend on 'dpatch' for modules-source. -- Kees Cook Sat, 7 Apr 2007 09:35:16 -0700 apparmor (2.0.1+510.dfsg-0ubuntu1) feisty; urgency=low * Initial release, thanks to Magnus Runesson and Jesse Michael (LP: #95334). -- Kees Cook Fri, 23 Mar 2007 16:42:01 -0700 debian/notify/0000755000000000000000000000000011773235147010510 5ustar debian/notify/90apparmor-notify0000644000000000000000000000107411773235147013735 0ustar # ------------------------------------------------------------------ # # Copyright (C) 2010 Canonical Ltd. # # This program is free software; you can redistribute it and/or # modify it under the terms of version 2 of the GNU General Public # License published by the Free Software Foundation. # # ------------------------------------------------------------------ # Start up apparmor notify. It will read /etc/apparmor/notify.conf and # $HOME/.apparmor/notify.conf for configuration. if [ -x /usr/bin/aa-notify ]; then /usr/bin/aa-notify -p -s 1 -w 60 fi debian/apparmor.maintscript0000644000000000000000000000016211773235147013277 0ustar rm_conffile /etc/apparmor/functions 2.5.1-0ubuntu4 rm_conffile /etc/apparmor/rc.apparmor.functions 2.5.1-0ubuntu4 debian/apparmor-utils.manpages0000644000000000000000000000104011773235147013667 0ustar debian/tmp/usr/share/man/man8/aa-complain.8 debian/tmp/usr/share/man/man8/aa-decode.8 debian/tmp/usr/share/man/man8/aa-genprof.8 debian/tmp/usr/share/man/man8/aa-audit.8 debian/tmp/usr/share/man/man8/aa-logprof.8 debian/tmp/usr/share/man/man8/aa-autodep.8 debian/tmp/usr/share/man/man8/aa-unconfined.8 debian/tmp/usr/share/man/man8/aa-enforce.8 debian/tmp/usr/share/man/man8/aa-disable.8 debian/tmp/usr/share/man/man8/aa-exec.8 debian/tmp/usr/share/man/man8/aa-easyprof.8 debian/tmp/usr/share/man/man5/logprof.conf.5 debian/aa-update-browser.8 debian/dh-apparmor.manpages0000644000000000000000000000003711773235147013127 0ustar debian/debhelper/dh_apparmor.1 debian/apparmor.postrm0000644000000000000000000000230011773235147012262 0ustar #!/bin/sh # postrm script for apparmor # # see: dh_installdeb(1) set -e # summary of how this script can be called: # * `remove' # * `purge' # * `upgrade' # * `failed-upgrade' # * `abort-install' # * `abort-install' # * `abort-upgrade' # * `disappear' # # for details, see http://www.debian.org/doc/debian-policy/ or # the debian-policy package case "$1" in purge) if [ -e /usr/share/debconf/confmodule ]; then . /usr/share/debconf/confmodule db_purge fi if [ -e "/etc/apparmor.d/tunables/home.d/ubuntu" ]; then rm -f /etc/apparmor.d/tunables/home.d/ubuntu fi ;; abort-install|abort-upgrade|remove|upgrade|failed-upgrade|disappear) ;; *) echo "postrm called with unknown argument \`$1'" >&2 exit 1 ;; esac # dh_installdeb will replace this with shell code automatically # generated by other debhelper scripts. #DEBHELPER# exit 0 debian/aa-update-browser0000644000000000000000000000670511773235147012455 0ustar #!/bin/sh # # Copyright (C) 2010 Canonical, Ltd. # Author: Jamie Strandboge # License: GPLv2 # # Program for updating browser abstractions in Ubuntu. The program will # search the specified profile for an include directive for a file in # abstractions/ubuntu-browsers.d and update this file with the specified # browsers abstractions. set -e topdir="/etc/apparmor.d" reldir="abstractions/ubuntu-browsers.d" dir="$topdir/$reldir" if [ ! -d "$dir" ]; then echo "'$dir' is not a directory" >&2 exit 1 fi help() { cat < -u comma separated list of abstractions for profile to use -d dry-run. Only show what would be done. -l list available abstractions -h this message Eg: $ aa-update-browser -l # aa-update-browser -u multimedia,productivity /etc/apparmor.d/usr.bin.firefox EOM } find_browser_include() { fn="$1" r=`egrep " *#include <$reldir/.*> *(|#.*)" "$fn" | cut -f 2 -d '<' | cut -f 1 -d '>'` if [ -z "$r" ]; then echo "Could not find '#include <$reldir/...>' in" >&2 echo "$fn" >&2 return fi basename "$r" } existing_abstractions="" for i in $dir/* ; do if [ ! -s "$i" ]; then continue fi if head -1 "$i" | grep -q '^# This file is updated' ; then continue fi # This has a leading space, which we use below. existing_abstractions="$existing_abstractions `basename $i`" done updated= dryrun= while getopts "dhlu:" opt do case "$opt" in d) dryrun="yes";; u) updated="$OPTARG";; l) echo "$existing_abstractions" exit 0 ;; h) help exit 0 ;; ?) help exit 1 ;; esac done shift $(($OPTIND - 1)) if [ -z "$1" ]; then help exit 1 fi for p in $* ; do if [ ! -s "$p" ]; then echo "Could not find '$p'" >&2 exit 1 fi include=`find_browser_include $p` if [ -z "$include" ]; then exit 1 fi if echo "$existing_abstractions" | grep -q " $include" ; then echo "'$reldir/$include' is an existing abstraction" >&2 exit 1 fi tmp=`mktemp` plugins_common_path="$dir/plugins-common" cat > "$tmp" < EOM for a in `echo "$updated" | tr [,] ' '`; do echo "$existing_abstractions" | egrep -q " $a( |$)" || { echo "'$a' is not an existing abstraction. Skipping." >&2 continue } if [ -f "$dir/$a" ]; then # TODO: add $plugins_common_path only for those browser abstractions # that actually need it. if [ -n "$plugins_common_path" ] && [ -e "$plugins_common_path" ]; then echo "#include <$reldir/`basename $plugins_common_path`>" >> "$tmp" plugins_common_path="" fi echo "#include <$reldir/$a>" >> "$tmp" else echo "Skipping '$a' (not found in '$dir')" >&2 continue fi done if [ "$dryrun" = "yes" ]; then echo "Skipping commit to '$dir/$include' (dry run)" >&2 cat "$tmp" rm -f "$tmp" continue fi mv -f "$tmp" "$dir/$include" || { rm -f "$tmp" exit 1 } chmod 644 "$dir/$include" done debian/libapache2-mod-apparmor.preinst0000644000000000000000000000131611773235147015175 0ustar #!/bin/sh # preinst script for libapache2-mod-apparmor # # see: dh_installdeb(1) set -e APP_PROFILE="usr.lib.apache2.mpm-prefork.apache2" APP_CONFFILE="/etc/apparmor.d/$APP_PROFILE" APP_DISABLE="/etc/apparmor.d/disable/$APP_PROFILE" if [ "$1" = "install" ] || [ "$1" = "upgrade" ]; then # Disable AppArmor profile on install or upgrade from earlier than when we # first shipped the profile if the user does not already have a profile # defined if dpkg --compare-versions "$2" lt 2.3.1+1403-0ubuntu20 ; then if [ ! -e "$APP_CONFFILE" ]; then mkdir -p `dirname $APP_DISABLE` 2>/dev/null || true ln -sf $APP_CONFFILE $APP_DISABLE fi fi fi #DEBHELPER# exit 0 debian/libpam-apparmor.docs0000644000000000000000000000003611773235147013134 0ustar changehat/pam_apparmor/README debian/apparmor.postinst0000644000000000000000000000543711773235147012637 0ustar #!/bin/sh # postinst script for apparmor # # see: dh_installdeb(1) set -e . /usr/share/debconf/confmodule # summary of how this script can be called: # * `configure' # * `abort-upgrade' # * `abort-remove' `in-favour' # # * `abort-remove' # * `abort-deconfigure' `in-favour' # `removing' # # for details, see http://www.debian.org/doc/debian-policy/ or # the debian-policy package case "$1" in configure|abort-remove|abort-deconfigure) # Try to determine values for apparmor/homedirs if the administrator # hasn't already. if dpkg --compare-versions "$2" lt-nl "2.5~pre+bzr1362-0ubuntu2"; then db_get apparmor/homedirs if [ -z "$RET" ]; then # Get unique dirnames for uids between 1000 and 30000, then # format them appropriately for AppArmor dirs=`awk -F: '$3 >= 1000 && $3 < 30000 {printf "%s\n", $6}' /etc/passwd | xargs -d '\n' -n 1 dirname | grep -v '^/home$' | sed -e 's#\(.*\)#\\1/#g' | sed -e '/ / { s#\(.*\)#"\\1"#g }' | sort -u | tr '\n' ' '` if [ -n "$dirs" ]; then db_set apparmor/homedirs "$dirs" fi fi fi db_get apparmor/homedirs tmp=`mktemp` cat > "$tmp" <> "$tmp" <> "$tmp" </dev/null || true mv -f "$tmp" /etc/apparmor.d/tunables/home.d/ubuntu chmod 644 /etc/apparmor.d/tunables/home.d/ubuntu ;; abort-upgrade) # Nothing to do ;; *) echo "postinst called with unknown argument \`$1'" >&2 exit 1 ;; esac # dh_installdeb will replace this with shell code automatically # generated by other debhelper scripts. #DEBHELPER# # Now that AppArmor is started, attempt to reload profiles in the # case of upgrades (since dh_installinit has been forced not to unload # the profiles in the case of an upgrade). case "$1" in configure) if [ -x "/etc/init.d/apparmor" ]; then if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then invoke-rc.d apparmor reload || true else /etc/init.d/apparmor reload || true fi fi ;; esac exit 0 debian/apparmor-docs.docs0000644000000000000000000000002311773235147012614 0ustar parser/techdoc.pdf debian/python-libapparmor.install0000644000000000000000000000005511773235147014417 0ustar usr/lib/python*.*/site-packages/LibAppArmor* debian/profiles/0000755000000000000000000000000011773235147011023 5ustar debian/profiles/chromium-browser0000644000000000000000000000125611773235147014256 0ustar # This file is updated currently not managed by the package but in the future # will be overwritten on upgrades. # # For site-specific adjustments, please see: # /etc/apparmor.d/local/usr.bin.chromium-browser #include #include #include #include #include #include #include #include #include debian/libapache2-mod-apparmor.manpages0000644000000000000000000000005511773235147015303 0ustar debian/tmp/usr/share/man/man8/mod_apparmor.8 debian/apparmor-utils.dirs0000644000000000000000000000007511773235147013044 0ustar /etc/apparmor /usr/bin /usr/share/apparmor /var/log/apparmor debian/libapparmor1.symbols0000644000000000000000000000157111773235147013207 0ustar libapparmor.so.1 libapparmor1 #MINVER# APPARMOR_1.0@APPARMOR_1.0 2.6~devel APPARMOR_1.1@APPARMOR_1.1 2.6~devel IMMUNIX_1.0@IMMUNIX_1.0 2.6~devel aa_change_hat@APPARMOR_1.1 2.6~devel aa_change_hat_vargs@APPARMOR_1.1 2.6~devel aa_change_hatv@APPARMOR_1.1 2.6~devel aa_change_onexec@APPARMOR_1.1 2.6~devel aa_change_profile@APPARMOR_1.1 2.6~devel aa_find_mountpoint@APPARMOR_1.1 2.7.0~beta1+bzr1772 aa_getcon@APPARMOR_1.1 2.7.0~beta1+bzr1772 aa_getpeercon@APPARMOR_1.1 2.7.0~beta1+bzr1772 aa_getpeercon_raw@APPARMOR_1.1 2.7.0~beta1+bzr1772 aa_getprocattr@APPARMOR_1.1 2.7.0~beta1+bzr1772 aa_getprocattr_raw@APPARMOR_1.1 2.7.0~beta1+bzr1772 aa_gettaskcon@APPARMOR_1.1 2.7.0~beta1+bzr1772 aa_is_enabled@APPARMOR_1.1 2.7.0~beta1+bzr1772 change_hat@APPARMOR_1.0 2.6~devel change_hat@IMMUNIX_1.0 2.6~devel free_record@APPARMOR_1.0 2.6~devel parse_record@APPARMOR_1.0 2.6~devel debian/apparmor-notify.manpages0000644000000000000000000000005211773235147014041 0ustar debian/tmp/usr/share/man/man8/aa-notify.8 debian/apparmor-profiles.postrm0000644000000000000000000000254311773263156014115 0ustar #!/bin/sh # postrm script for apparmor-profiles # # see: dh_installdeb(1) set -e PURGE_LIST="/var/lib/dpkg/info/.apparmor-profiles.list" case "$1" in purge) if [ -e /etc/apparmor.d/abstractions/ubuntu-browsers.d/chromium-browser ]; then rm -f /etc/apparmor.d/abstractions/ubuntu-browsers.d/chromium-browser fi # We automatically create local/* files in postinst, so we need to # remove them on purge. if [ -e $PURGE_LIST ]; then grep "/etc/apparmor.d/" $PURGE_LIST | while read profile ; do f="/etc/apparmor.d/local/`basename $profile`" if [ -f "$f" ]; then rm -f "$f" fi done rm -f $PURGE_LIST fi ;; remove) # dpkg now removes the conffiles from the .list file before calling # "purge", so we need to retain the list ourselves for that phase. if [ -e "/var/lib/dpkg/info/apparmor-profiles.list" ]; then cp -a /var/lib/dpkg/info/apparmor-profiles.list $PURGE_LIST fi ;; upgrade|failed-upgrade|disappear) ;; *) echo "postrm called with unknown argument \`$1'" >&2 exit 1 ;; esac # dh_installdeb will replace this with shell code automatically # generated by other debhelper scripts. #DEBHELPER# exit 0