[Bug 1042082] New: Add support for new AppArmor rule types
http://bugzilla.opensuse.org/show_bug.cgi?id=1042082 Bug ID: 1042082 Summary: Add support for new AppArmor rule types Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-maintainers@forge.provo.novell.com Reporter: suse-beta@cboltz.de QA Contact: qa-bugs@suse.de CC: jrjohansen117@gmail.com Found By: --- Blocker: --- Support for several new AppArmor rule types is on the way to the upstream kernel: - dbus - mount - signal - ptrace - pivot_root - unix Also, support for profile stacking will be added and policy namespace support improved. Those new rule types are needed to make Snappy secure - without them, it's hard or even impossible to make sure snaps don't do something they shouldn't. For example, it would be impossible to restrict dbus access to only the required parts. Of course those new rules will also be useful for "normal" applications. Note that adding support for those rules in a service pack is a bad idea because it might need profile updates, therefore it would be a *very* good idea to backport them to whatever kernel will be shipped in Leap 15/SLE 15. The first base patches are already in 4.11. The next bunch is on its way to 4.12, and the goal is to get the final parts into 4.13 and 4.14. Upstream (especially John Johansen, in CC) promised to send the pull request for 4.13 in the next days. The remaining patches for 4.14 will follow in about two months - or a bit earlier if you don't insist on the final version of those patches. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1042082 http://bugzilla.opensuse.org/show_bug.cgi?id=1042082#c1 --- Comment #1 from John Johansen <jrjohansen117@gmail.com> --- Unfortunately upstream 4.13 will not be sufficient. The goal now is to get the remaining changes into 4.14. If backporting to an older kernel I would use the git://kernel.ubuntu.com/jj/linux-apparmor-backports tree. A new series of branches will be added based on the 4.13 version of apparmor. It will provide a small patch series (2 base patches - 1 securityfs, 1 apparmor and then any necessary backport patches for the target kernel version). The final version of the 4.13 backport branch will not be available until at earliest the close of the 4.13 merge window. But a early version could be made available next week. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1042082 http://bugzilla.opensuse.org/show_bug.cgi?id=1042082#c3 --- Comment #3 from Christian Boltz <suse-beta@cboltz.de> --- I won't stop you if you need/create a FATE entry - but please keep in mind that you should create a public FATE entry. Also, please tell us the number so that John and I can subscribe to the notifications about changes and can help you if you have questions. (In other words: staying in bugzilla makes things a bit easier for John and me.) -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1042082 http://bugzilla.opensuse.org/show_bug.cgi?id=1042082#c4 --- Comment #4 from Takashi Iwai <tiwai@suse.com> --- Well, it's better you open a FATE entry, not me :) Bugzilla isn't the best place to track such a feature request like this. It should be processed via FATE, in general -- especially if it's not even implemented fully in the upstream. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1042082 http://bugzilla.opensuse.org/show_bug.cgi?id=1042082#c5 --- Comment #5 from Christian Boltz <suse-beta@cboltz.de> --- OK, paperwork done ;-) - https://features.opensuse.org/323500 -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com