Release: Bump revisions for 2.13.6 release

Signed-off-by: John Johansen <john.johansen@canonical.com>

common/Version

@@ -1 +1 @@
-2.13.5
+2.13.6

libraries/libapparmor/src/Makefile.am

@@ -28,7 +28,7 @@ INCLUDES = $(all_includes)
 #
 AA_LIB_CURRENT = 7
 AA_LIB_REVISION = 3
-AA_LIB_AGE = 7
+AA_LIB_AGE = 6
 
 SUFFIXES = .pc.in .pc
 

profiles/apparmor.d/abstractions/X

@@ -49,6 +49,8 @@
 
   # Xcompose
   owner @{HOME}/.XCompose         r,
+  /var/cache/libx11/compose/*     r,
+  deny /var/cache/libx11/compose/* wlk,
 
   # mouse themes
   /etc/X11/cursors/               r,

profiles/apparmor.d/usr.lib.dovecot.script-login

@@ -0,0 +1,33 @@
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2020 Michael Hirmke
+#    Copyright (C) 2020 Christian Boltz
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+# vim: ft=apparmor
+
+#include <tunables/global>
+
+profile dovecot-script-login /usr/lib/dovecot/script-login {
+  #include <abstractions/base>
+  #include <abstractions/dovecot-common>
+  #include <abstractions/nameservice>
+
+  capability setuid,
+
+  /usr/lib/dovecot/script-login mrPx,
+
+  # NOTE: You'll need to allow execution of your actual login script.
+  # The recommended way is to add a rule for it in local/usr.lib.dovecot.script-login
+  # for example
+  #   /home/vmail/bin/postlogin.sh Px,
+  # and then to create the profile for the script.
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.lib.dovecot.script-login>
+}
+

profiles/apparmor.d/usr.sbin.dovecot

@@ -31,7 +31,8 @@ profile dovecot /usr/{bin,sbin}/dovecot flags=(attach_disconnected) {
   capability sys_chroot,
   capability sys_resource,
 
-  signal send set=(int,quit,term) peer=/usr/lib/dovecot/*,
+  signal send set=(int,quit,term,kill) peer=/usr/lib/dovecot/*,
+  signal send set=(int,quit,term,kill) peer=dovecot-*,
 
   unix (receive, send) type=stream peer=(label=/usr/lib/dovecot/anvil),
 
@@ -55,10 +56,12 @@ profile dovecot /usr/{bin,sbin}/dovecot flags=(attach_disconnected) {
   /usr/lib/dovecot/managesieve-login Pxmr,
   /usr/lib/dovecot/pop3 mrPx,
   /usr/lib/dovecot/pop3-login Pxmr,
+  /usr/lib/dovecot/script-login Px,
   /usr/lib/dovecot/ssl-build-param rix,
   /usr/lib/dovecot/ssl-params mrPx,
   /usr/lib/dovecot/stats Px,
   /usr/{bin,sbin}/dovecot mrix,
+  /usr/share/dovecot/dh.pem r,
   /usr/share/dovecot/protocols.d/   r,
   /usr/share/dovecot/protocols.d/** r,
   /var/lib/dovecot/ w,

utils/aa-genprof

@@ -72,20 +72,14 @@ if args.json:
     aaui.set_json_mode()
 
 profiling = args.program
-profiledir = args.dir
 
-apparmor.init_aa()
+apparmor.init_aa(profiledir=args.dir)
 apparmor.set_logfile(args.file)
 
 aa_mountpoint = apparmor.check_for_apparmor()
 if not aa_mountpoint:
     raise apparmor.AppArmorException(_('It seems AppArmor was not started. Please enable AppArmor and try again.'))
 
-if profiledir:
-    apparmor.profile_dir = apparmor.get_full_path(profiledir)
-    if not os.path.isdir(apparmor.profile_dir):
-        raise apparmor.AppArmorException(_("%s is not a directory.") %profiledir)
-
 program = None
 #if os.path.exists(apparmor.which(profiling.strip())):
 if os.path.exists(profiling):

utils/aa-logprof

@@ -13,7 +13,6 @@
 #
 # ----------------------------------------------------------------------
 import argparse
-import os
 
 import apparmor.aa as apparmor
 import apparmor.ui as aaui
@@ -36,21 +35,16 @@ args = parser.parse_args()
 if args.json:
     aaui.set_json_mode()
 
-profiledir = args.dir
 logmark = args.mark or ''
 
-apparmor.init_aa()
+apparmor.init_aa(profiledir=args.dir)
+
 apparmor.set_logfile(args.file)
 
 aa_mountpoint = apparmor.check_for_apparmor()
 if not aa_mountpoint:
     raise apparmor.AppArmorException(_('It seems AppArmor was not started. Please enable AppArmor and try again.'))
 
-if profiledir:
-    apparmor.profile_dir = apparmor.get_full_path(profiledir)
-    if not os.path.isdir(apparmor.profile_dir):
-        raise apparmor.AppArmorException("%s is not a directory."%profiledir)
-
 apparmor.loadincludes()
 
 apparmor.do_logprof_pass(logmark)

utils/aa-mergeprof

@@ -14,7 +14,6 @@
 #
 # ----------------------------------------------------------------------
 import argparse
-import os
 
 import apparmor.aa
 import apparmor.aamode
@@ -23,7 +22,6 @@ import apparmor.severity
 import apparmor.cleanprofile as cleanprofile
 import apparmor.ui as aaui
 
-from apparmor.common import AppArmorException
 from apparmor.regex import re_match_include
 
 
@@ -43,15 +41,10 @@ args = parser.parse_args()
 
 args.other = None
 
-apparmor.aa.init_aa()
+apparmor.aa.init_aa(profiledir=args.dir)
 
 profiles = args.files
 
-profiledir = args.dir
-if profiledir:
-    apparmor.aa.profile_dir = apparmor.aa.get_full_path(profiledir)
-    if not os.path.isdir(apparmor.aa.profile_dir):
-        raise AppArmorException(_("%s is not a directory.") %profiledir)
 
 def reset_aa():
     apparmor.aa.aa = apparmor.aa.hasher()

utils/apparmor/aa.py

@@ -3233,7 +3233,7 @@ def logger_path():
 
 ######Initialisations######
 
-def init_aa(confdir="/etc/apparmor"):
+def init_aa(confdir="/etc/apparmor", profiledir=None):
     global CONFDIR
     global conf
     global cfg
@@ -3256,7 +3256,11 @@ def init_aa(confdir="/etc/apparmor"):
     if cfg['settings'].get('default_owner_prompt', False):
         cfg['settings']['default_owner_prompt'] = ''
 
-    profile_dir = conf.find_first_dir(cfg['settings'].get('profiledir')) or '/etc/apparmor.d'
+    if profiledir:
+        profile_dir = profiledir
+    else:
+        profile_dir = conf.find_first_dir(cfg['settings'].get('profiledir')) or '/etc/apparmor.d'
+    profile_dir = os.path.abspath(profile_dir)
     if not os.path.isdir(profile_dir):
         raise AppArmorException('Can\'t find AppArmor profiles in %s' % (profile_dir))
 

utils/apparmor/tools.py

@@ -25,10 +25,9 @@ _ = init_translation()
 
 class aa_tools:
     def __init__(self, tool_name, args):
-        apparmor.init_aa()
+        apparmor.init_aa(profiledir=args.dir)
 
         self.name = tool_name
-        self.profiledir = args.dir
         self.profiling = args.program
         self.check_profile_dir()
         self.silent = None
@@ -43,11 +42,6 @@ class aa_tools:
             self.silent = args.silent
 
     def check_profile_dir(self):
-        if self.profiledir:
-            apparmor.profile_dir = apparmor.get_full_path(self.profiledir)
-            if not os.path.isdir(apparmor.profile_dir):
-                raise apparmor.AppArmorException("%s is not a directory." % self.profiledir)
-
         if not user_perm(apparmor.profile_dir):
             raise apparmor.AppArmorException("Cannot write to profile directory: %s" % (apparmor.profile_dir))
 
@@ -183,6 +177,7 @@ class aa_tools:
 
     def cmd_autodep(self):
         apparmor.read_profiles()
+        apparmor.loadincludes()
 
         for (program, profile) in self.get_next_to_profile():
             if not program:

utils/po/id.po

@@ -1147,11 +1147,11 @@ msgstr "(B)aru"
 
 #: ../apparmor/ui.py:254
 msgid "(G)lob"
-msgstr "(G)umpal"
+msgstr "G(u)mpal"
 
 #: ../apparmor/ui.py:255
 msgid "Glob with (E)xtension"
-msgstr "Gumpal dengan (E)kstensi"
+msgstr "Gumpal dengan E(k)stensi"
 
 #: ../apparmor/ui.py:256
 msgid "(A)dd Requested Hat"
@@ -1159,7 +1159,7 @@ msgstr "(T)ambahkan Topi yang Diminta"
 
 #: ../apparmor/ui.py:257
 msgid "(U)se Default Hat"
-msgstr "(G)unakan Topi Default"
+msgstr "Gunakan Topi (D)efault"
 
 #: ../apparmor/ui.py:258
 msgid "(S)can system log for AppArmor events"
@@ -1175,7 +1175,7 @@ msgstr "(L)ihat Profil"
 
 #: ../apparmor/ui.py:261
 msgid "(U)se Profile"
-msgstr "(G)unakan Profil"
+msgstr "Gunakan (P)rofil"
 
 #: ../apparmor/ui.py:262
 msgid "(C)reate New Profile"

utils/po/sv.po

@@ -990,7 +990,7 @@ msgstr ""
 
 #: ../apparmor/ui.py:223
 msgid "(A)llow"
-msgstr "(T)illåt"
+msgstr "Ti(l)låt"
 
 #: ../apparmor/ui.py:224
 msgid "(M)ore"

utils/test/test-translations.py

@@ -62,7 +62,7 @@ class TestHotkeyConflicts(AATest):
             keys = dict()
             for key in params:
                 text = t.gettext(CMDS[key])
-                hotkey = get_translated_hotkey(text)
+                hotkey = get_translated_hotkey(text).lower()
 
                 if keys.get(hotkey):
                     raise Exception("Hotkey conflict: '%s' and '%s' in language %s" % (keys[hotkey], text, language))