Hi,
Adam D. Barratt:
> What's the difference between this and +deb9u1? Is it simply this
> change:
> -++features-file=/etc/apparmor/features
> +++features-file=/usr/share/apparmor-features/features
> and the equivalent in debian/install?
Yes (modulo the timing matter regarding the Linux 4.14.x bug, which
was the only reason why +deb9u1 could not make it into a stable
release last time).
> The changelog going from -3 to -3+deb9u2 is confusing, particularly
> given that +deb9u1 has been available to users of proposed-updates for
> some time. If the above is correct, please keep the previous changelog
> stanza for +deb9u1 as-is and add a new entry for +deb9u2 describing the
> path change.
Done and accordingly adjusted the maintainer scripts to remove
the old (now obsolete) /etc/apparmor/features conffile from systems
that had +deb9u1 installed.
I'm attaching 2 updated debdiffs: one from the version in Stretch and
the other one from the version that's already in stable p-u.
Cheers,
--
intrigeri
diff -Nru apparmor-2.11.0/debian/apparmor.install apparmor-2.11.0/debian/apparmor.install
--- apparmor-2.11.0/debian/apparmor.install 2017-03-28 12:23:08.000000000 +0200
+++ apparmor-2.11.0/debian/apparmor.install 2018-02-27 07:46:39.000000000 +0100
@@ -1,4 +1,5 @@
debian/apport/source_apparmor.py /usr/share/apport/package-hooks/
+debian/features /usr/share/apparmor-features/
debian/lib/apparmor/functions /lib/apparmor/
debian/lib/apparmor/profile-load /lib/apparmor/
etc/apparmor/parser.conf
diff -Nru apparmor-2.11.0/debian/apparmor.maintscript apparmor-2.11.0/debian/apparmor.maintscript
--- apparmor-2.11.0/debian/apparmor.maintscript 2015-08-13 21:25:45.000000000 +0200
+++ apparmor-2.11.0/debian/apparmor.maintscript 2018-02-27 07:46:39.000000000 +0100
@@ -1,3 +1,4 @@
rm_conffile /etc/apparmor/functions 2.5.1-0ubuntu4
rm_conffile /etc/apparmor/rc.apparmor.functions 2.5.1-0ubuntu4
rm_conffile /etc/apparmor.d/abstractions/ubuntu-sdk-base 2.8.0-0ubuntu20~
+rm_conffile /etc/apparmor/features 2.11.0-3+deb9u2~
diff -Nru apparmor-2.11.0/debian/changelog apparmor-2.11.0/debian/changelog
--- apparmor-2.11.0/debian/changelog 2017-03-28 12:29:15.000000000 +0200
+++ apparmor-2.11.0/debian/changelog 2018-02-27 07:46:39.000000000 +0100
@@ -1,3 +1,24 @@
+apparmor (2.11.0-3+deb9u2) UNRELEASED; urgency=medium
+
+ * Move the features file to /usr/share/apparmor-features;
+ accordingly remove the old (now obsolete) '/etc/apparmor/features'
+ conffile (Closes: #883682).
+ * Configure gbp for DEP-14 and avoid gbp-pq prefixing patches
+ with numbers.
+
+ -- intrigeri <intrig...@debian.org> Tue, 27 Feb 2018 06:46:39 +0000
+
+apparmor (2.11.0-3+deb9u1) stretch; urgency=medium
+
+ * Pin the AppArmor feature set to Stretch's kernel (Closes: #879585).
+ This ensures Stretch systems, even when running a newer kernel (e.g.
+ from backports), have their AppArmor feature set pinned to the one
+ supported by the AppArmor policy shipped in Stretch. Otherwise they
+ would experience breakage due to new AppArmor mediation features
+ introduced in recent kernels.
+
+ -- intrigeri <intrig...@debian.org> Sat, 25 Nov 2017 18:04:05 +0000
+
apparmor (2.11.0-3) unstable; urgency=medium
* Fix CVE-2017-6507: don't unload unknown profiles during package
diff -Nru apparmor-2.11.0/debian/features apparmor-2.11.0/debian/features
--- apparmor-2.11.0/debian/features 1970-01-01 01:00:00.000000000 +0100
+++ apparmor-2.11.0/debian/features 2018-02-27 07:46:39.000000000 +0100
@@ -0,0 +1,23 @@
+caps {mask {chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read
+}
+}
+rlimit {mask {cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime
+}
+}
+capability {0xffffff
+}
+file {mask {create read write exec append mmap_exec link lock
+}
+}
+domain {change_profile {yes
+}
+change_onexec {yes
+}
+change_hatv {yes
+}
+change_hat {yes
+}
+}
+policy {set_load {yes
+}
+}
diff -Nru apparmor-2.11.0/debian/gbp.conf apparmor-2.11.0/debian/gbp.conf
--- apparmor-2.11.0/debian/gbp.conf 1970-01-01 01:00:00.000000000 +0100
+++ apparmor-2.11.0/debian/gbp.conf 2018-02-27 07:46:39.000000000 +0100
@@ -0,0 +1,6 @@
+[DEFAULT]
+pristine-tar = True
+debian-branch = debian/stretch
+upstream-branch = upstream/latest
+upstream-vcs-tag = v%(version)s
+patch-numbers = False
diff -Nru apparmor-2.11.0/debian/patches/pin-feature-set.patch apparmor-2.11.0/debian/patches/pin-feature-set.patch
--- apparmor-2.11.0/debian/patches/pin-feature-set.patch 1970-01-01 01:00:00.000000000 +0100
+++ apparmor-2.11.0/debian/patches/pin-feature-set.patch 2018-02-27 07:46:39.000000000 +0100
@@ -0,0 +1,18 @@
+Description: pin the AppArmor feature set to the one shipped by the apparmor package
+ .
+ Let's smooth UX on kernel upgrades and allow ourselves to update the AppArmor
+ policy in a relaxed manner.
+Bug-Debian: https://bugs.debian.org/879585
+Forwarded: not-needed
+Author: intrigeri <intrig...@debian.org>
+
+--- a/parser/parser.conf
++++ b/parser/parser.conf
+@@ -59,3 +59,7 @@
+ ## Adjust compression
+ #Optimize=compress-small
+ #Optimize=compress-fast
++
++## Pin feature set (avoid regressions when policy is lagging behind
++## the kernel)
++features-file=/usr/share/apparmor-features/features
diff -Nru apparmor-2.11.0/debian/patches/series apparmor-2.11.0/debian/patches/series
--- apparmor-2.11.0/debian/patches/series 2017-03-28 12:24:44.000000000 +0200
+++ apparmor-2.11.0/debian/patches/series 2018-02-27 07:46:39.000000000 +0100
@@ -2,6 +2,7 @@
# Debian-specific patches
#
+pin-feature-set.patch
notify-group.patch
#
diff -Nru apparmor-2.11.0/debian/apparmor.install apparmor-2.11.0/debian/apparmor.install
--- apparmor-2.11.0/debian/apparmor.install 2017-11-25 19:01:04.000000000 +0100
+++ apparmor-2.11.0/debian/apparmor.install 2018-02-27 07:46:39.000000000 +0100
@@ -1,5 +1,5 @@
debian/apport/source_apparmor.py /usr/share/apport/package-hooks/
-debian/features /etc/apparmor/
+debian/features /usr/share/apparmor-features/
debian/lib/apparmor/functions /lib/apparmor/
debian/lib/apparmor/profile-load /lib/apparmor/
etc/apparmor/parser.conf
diff -Nru apparmor-2.11.0/debian/apparmor.maintscript apparmor-2.11.0/debian/apparmor.maintscript
--- apparmor-2.11.0/debian/apparmor.maintscript 2017-11-25 18:51:07.000000000 +0100
+++ apparmor-2.11.0/debian/apparmor.maintscript 2018-02-27 07:46:39.000000000 +0100
@@ -1,3 +1,4 @@
rm_conffile /etc/apparmor/functions 2.5.1-0ubuntu4
rm_conffile /etc/apparmor/rc.apparmor.functions 2.5.1-0ubuntu4
rm_conffile /etc/apparmor.d/abstractions/ubuntu-sdk-base 2.8.0-0ubuntu20~
+rm_conffile /etc/apparmor/features 2.11.0-3+deb9u2~
diff -Nru apparmor-2.11.0/debian/changelog apparmor-2.11.0/debian/changelog
--- apparmor-2.11.0/debian/changelog 2017-11-25 19:04:05.000000000 +0100
+++ apparmor-2.11.0/debian/changelog 2018-02-27 07:46:39.000000000 +0100
@@ -1,3 +1,13 @@
+apparmor (2.11.0-3+deb9u2) UNRELEASED; urgency=medium
+
+ * Move the features file to /usr/share/apparmor-features;
+ accordingly remove the old (now obsolete) '/etc/apparmor/features'
+ conffile (Closes: #883682).
+ * Configure gbp for DEP-14 and avoid gbp-pq prefixing patches
+ with numbers.
+
+ -- intrigeri <intrig...@debian.org> Tue, 27 Feb 2018 06:46:39 +0000
+
apparmor (2.11.0-3+deb9u1) stretch; urgency=medium
* Pin the AppArmor feature set to Stretch's kernel (Closes: #879585).
diff -Nru apparmor-2.11.0/debian/gbp.conf apparmor-2.11.0/debian/gbp.conf
--- apparmor-2.11.0/debian/gbp.conf 1970-01-01 01:00:00.000000000 +0100
+++ apparmor-2.11.0/debian/gbp.conf 2018-02-27 07:46:39.000000000 +0100
@@ -0,0 +1,6 @@
+[DEFAULT]
+pristine-tar = True
+debian-branch = debian/stretch
+upstream-branch = upstream/latest
+upstream-vcs-tag = v%(version)s
+patch-numbers = False
diff -Nru apparmor-2.11.0/debian/patches/pin-feature-set.patch apparmor-2.11.0/debian/patches/pin-feature-set.patch
--- apparmor-2.11.0/debian/patches/pin-feature-set.patch 2017-11-25 18:59:40.000000000 +0100
+++ apparmor-2.11.0/debian/patches/pin-feature-set.patch 2018-02-27 07:46:39.000000000 +0100
@@ -2,7 +2,7 @@
.
Let's smooth UX on kernel upgrades and allow ourselves to update the AppArmor
policy in a relaxed manner.
-Bug-Debian: https://bugs.debian.org/879585
+Bug-Debian: https://bugs.debian.org/879585
Forwarded: not-needed
Author: intrigeri <intrig...@debian.org>
@@ -15,4 +15,4 @@
+
+## Pin feature set (avoid regressions when policy is lagging behind
+## the kernel)
-+features-file=/etc/apparmor/features
++features-file=/usr/share/apparmor-features/features
