Ubuntu
click-apparmor package

aa-clickhook -f does not properly consider changes to abstractions and #include directories

Bug #1238007 reported by Jamie Strandboge
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
click-apparmor (Ubuntu)
Won't Fix
Wishlist
Unassigned

Bug Description

click-apparmor tries very hard to only use apparmor_parser when needed, but it is too aggressive currently. Right now it will only hit the parser if the output of easyprof changes. However, if an abstraction changes or something in the new /usr/share/apparmor/hardware directories change, the policy won't be updated. This needs to be fixed.

Jamie Strandboge (jdstrand)
Changed in click-apparmor (Ubuntu):
status: New → Triaged
importance: Undecided → High
assignee: nobody → Jamie Strandboge (jdstrand)
tags: added: application-confinement
Jamie Strandboge (jdstrand)
Changed in click-apparmor (Ubuntu):
importance: High → Undecided
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Marking as wishlist since we are solving this in other ways via the boot scripts.

Changed in click-apparmor (Ubuntu):
assignee: Jamie Strandboge (jdstrand) → nobody
importance: Undecided → Wishlist
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

This could be solved by performing a checksum of 'apparmor_parser -p', storing it and then do comparisons against it later. This does have a performance impact, but could conceivably cleanup the boot logic quite a bit.

Jamie Strandboge (jdstrand)
Changed in click-apparmor (Ubuntu):
status: Triaged → In Progress
assignee: nobody → Jamie Strandboge (jdstrand)
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

click-apparmor is in maintenance mode and will not gain new features since Touch will eventually move to snapd which doesn't use click-apparmor. Marking as Won't Fix.

Changed in click-apparmor (Ubuntu):
status: In Progress → Won't Fix
assignee: Jamie Strandboge (jdstrand) → nobody
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.