This bug was fixed in the package apparmor - 2.13.3-7ubuntu5.2
---------------
apparmor (2.13.3-7ubuntu5.2) focal; urgency=medium
* Add capability upstream patches to fix LP: #1964636
- u/cap1-Generate-CAPABILITIES-in-a-script-due-to-make-4.3.patch: move
code that generates a list of capabilities to a script in common/
- u/cap2-parser-Move-to-a-pre-generated-cap_names.h.patch: use a
pre-generated list of capabilities so that all capabilities are
supported even when building against older kernels.
- u/cap3-parser-cleanup-capability_table-generation-by-droppi.patch: drop
sys_log static declaration because it's already in the generated list.
- u/cap4-parser-unify-capability-name-handling.patch: drop internal
hardcoded capability table.
- u/cap5-parser-Makefile-use-LC_ALL-C-when-invoking-sed.patch: use
LC_ALL=C when invoking sed.
- u/cap6-parser-Add-warning-to-capability_table-about-the-nee.patch: add
warning to capability_table about the need to update the Makefile.
- u/cap7-Add-CAP_BPF-and-CAP_PERFMON-to-severity.db.patch: add
support for cap_bpf and cap_perfmon
- u/cap8-parser-Makefile-fix-generated-cap-comparison-against.patch: fix
generated cap comparison against known list
* Add upstream patches for abi support. LP: #1728130
- u/abi1-parser-feature-abi-setup-parser-to-intersect-policy-.patch: add
the ability to intersect parser and kernel features in the parser.
- u/abi2-parser-add-basic-support-for-feature-abis.patch: add support
to specify a feature abi.
- u/abi3-pin-abi-2.13.patch: add and pin a policy abi for 2.13
- u/abi4-parser-fix-abi-rule-and-pinned-feature-file-interact.patch: fix
abi rule and pinned feature file interaction
- apparmor.install: add 2.13 abi file to be installed in
/etc/apparmor.d/abi/
* Add mqueue patches. LP: #1993353
- u/mqueue1-parser-add-parser-support-for-message-queue-mediatio.patch:
add parser support for mqueue mediation
- u/mqueue2-tests-add-posix-message-queue-regression-tests.patch: add
posix mqueue regression tests
- u/mqueue3-utils-add-message-queue-rules-parsing-in-python-tool.patch:
add support in python tools to parse mqueue rules
- u/mqueue4-parser-add-parser-simple-tests-for-mqueue-rules.patch: add
parser simple tests for mqueue
- u/mqueue5-parser-place-perm-on-name-as-well-as-name-label-comb.patch:
add permissions on name and also on name + label
- u/mqueue6-libapparmor-add-support-for-requested-and-denied-on-.patch:
add parsing support for "denied" and "requested" from audit logs
- u/mqueue7-libapparmor-add-support-for-class-in-logparsing.patch: add
parsing support for "class" from audit logs
- u/mqueue8-utils-add-logparser-support-for-mqueue.patch: add logparser
support for mqueue rules
- u/mqueue9-tests-add-sysv-message-queue-regression-tests.patch: add
sysv mqueue regression tests
- u/mqueue10-parser-enable-mqueue-rules-when-abi-is-not-set.patch:
override pinned features for mqueue rules when abi is not set in policy.
- debian/rules: create mqueue testcase empty files for libapparmor tests.
* Closes LP: #1994146
-- Georgia Garcia <[email protected]> Mon, 10 Oct 2022
17:52:45 -0300
** Changed in: apparmor (Ubuntu Focal)
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1964636
Title:
Incorrect handling of apparmor `bpf` capability
Status in apparmor package in Ubuntu:
In Progress
Status in snapd package in Ubuntu:
Incomplete
Status in apparmor source package in Focal:
Fix Released
Bug description:
[ Impact ]
The apparmor_parser before the 3.0 release would build its capability list
from the installed kernel headers. The apparmor_parser was built against a
kernel without support for cap 'bpf'
This was fixed in 3.0 by having a static caps list (with full mapping info)
and the dynamic auto-generated list (against the kernel headers) that is used
to check that the static list has not become stale. In addition the parser can
pull kernel supported caps straight from the apparmor kernel module (it will
however be missing the mapping info).
Backporting the patches from 3.0 fixes the issue.
[ Test Plan ]
Before the fix, the following profile fails loading:
# echo "profile foo { capability bpf, }" | apparmor_parser -Q
AppArmor parser error, in stdin line 1: Invalid capability bpf.
# echo $?
1
After the fix, it works as expected:
# echo "profile foo { capability bpf, }" | apparmor_parser -Q
# echo $?
0
[ Where problems could occur ]
With these changes, the parser can change its behavior based on a few things.
1. the kernel its built against. This would not change behavior when run in a
container vs at system level.
2. If a feature-file is specified, via --features-file, --policy-
features, or --kernel-features. This allows overriding the normal
policy and kernel examination that the parser does when compiling
policy.
3. If /sys/kernel/security/apparmor/features is not available. The
parser will fallback to an old set of features available in a kernel
before the kernel module started exporting what the kernel module
supports on the running kernel.
[ Other Info ]
The patches for focal (apparmor-2.13) can be found at:
https://launchpad.net/~georgiag/+archive/ubuntu/mqueue-sru/
As mentioned before, these patches are already running on apparmor-3.0.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1964636/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
