mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-22 01:57:43 +00:00
acb45dc4b0
In AppArmor 2 distros could pin the feature file being used by setting the feature-file option in the config file. With AppArmor 3 policy is now explicitly tagged with an abi rule. The problem is the interaction on systems that have a mixture of AppArmor 2 and AppArmor 3 policy and use feature pinning. The feature pinning is required to make the apparmor 2 policy behave as expected but it also overrides the abi rules that are explicitly set as part of the policy. This means we either have the apparmor 2 pinned policy working as desired or the apparmor 3 policy, but not both. To fix this make setting the flag on command line or in config file lower priority than an abi rule specified in policy. The ability to override abi rules will be added in a separate patch. The Priority ordering to determine the policy abi to use is 1. Use abi rules if present 2. if no abi rule use command line option 3. if no abi rule or command line option use config setting 4. if none of the above use the default abi PR: https://gitlab.com/apparmor/apparmor/-/merge_requests/579 Signed-off-by: John Johansen <john.johansen@canonical.com>
The apparmor_parser allows you to add, replace, and remove AppArmor policy through the use of command line options. The default is to add. `apparmor_parser --help` shows what the command line options are. You can also find more information at https://wiki.apparmor.net -- The AppArmor development team