[FFe] apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in mantic
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
apparmor (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
As per the spec documented at https:/
This change requires changes in both AppArmor within the kernel, as well as the apparmor package in the Ubuntu archive to ensure it supports the new syntax required.
This has been extensively tested via the AppArmor regression test script in the QA Regression Testing repo: https:/
This script runs various tests against the installed apparmor package, as well as building and running the various upstream regression and other test suites against this installed package:
- https:/
- https:/
- https:/
- https:/
The package can be found in https:/
This includes build logs etc (e.g. for amd64 this is found at https:/
Note there is no ChangeLog file in upstream apparmor so instead I am attaching the git history between the current version of apparmor in mantic (3.0.8) and 4.0.0-alpha2.
Also note that this new version of apparmor does not actually enable the user namespaces restriction yet - that is planned for a future upload (and hence a future FFe) - however, it lays all the groundwork to enable this, once sufficient testing and integration has been done across the rest of the Ubuntu archive and package ecosystem.
As such, there is no risk of regression at this time due to that change - and the extensive regression testing also supports this conclusion as well.
description: | updated |
description: | updated |
tags: |
added: verification-done-noble-linux-oracle removed: verification-needed-noble-linux-oracle |
tags: |
added: verification-done-jammy-linux-lowlatency-hwe-6.8 removed: verification-needed-jammy-linux-lowlatency-hwe-6.8 |
apt log when installing new package