Add posix message queue IPC mediation
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
apparmor (Ubuntu) |
New
|
Undecided
|
Unassigned | ||
Focal |
Fix Released
|
Undecided
|
Unassigned | ||
Jammy |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
[ Impact ]
We need to add IPC mediation support in the userspace tools, starting with posix message queue.
This would improve security and lower the attack surface for applications
There is already a proposal upstream:
https:/
[ Test Plan ]
In the merge request in the description there are several tests added.
There are parser tests that can be run with "make -C parser check" in the project source tree.
There are also tests for the python tools that can be run ith "make -C utils check" in the project source tree.
There are also regression tests in tests/regressio
[ Where problems could occur ]
There could be problems related to Bug 1728130, where a policy was developed for a set of rules supported by a specific kernel, and if new mediation is available on newer kernels, then there will be some denied rules. Therefore we need to also prevent that from happening. This is already available in apparmor-3.+, but for older versions could be done by backporting the abi patches from
apparmor-3.0.
description: | updated |
tags: |
added: verification-done-focal removed: verification-needed-focal |
Hello Georgia, or anyone else affected,
Accepted apparmor into jammy-proposed. The package will build now and be available at https:/ /launchpad. net/ubuntu/ +source/ apparmor/ 3.0.4-2ubuntu2. 2 in a few hours, and then in the -proposed repository.
Please help us by testing this new package. See https:/ /wiki.ubuntu. com/Testing/ EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.
If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification- needed- jammy to verification- done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification- failed- jammy. In either case, without details of your testing we will not be able to proceed.
Further information regarding the verification process can be found at https:/ /wiki.ubuntu. com/QATeam/ PerformingSRUVe rification . Thank you in advance for helping!
N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.