3

Release_Notes_4.1.0

John Johansen edited this page 2025-04-10 09:50:54 +00:00

Table of Contents

• Introduction
• Highlighted new features
• Important Notes
• Known Issues
• Obtaining the Release
• gitlab release
• Launchpad Tarball
• Changes since AppArmor 4.0???
• Misc
• policy compiler (aka apparmor_parser)
• Policy
• profiles
• unconfined profiles
• Documentation
• Regression Tests
• Changes in this Release
• General improvements
• Policy Compiler (a.k.a apparmor_parser)
• Library
• Utils
• Policy
• abstractions
• profiles
• unconfined profiles
• Documentation
• Translations
• Infrastructure
• Tests
• Bug Fixes
• Feature Matrix

AppArmor 4.1 was released 2025-03-08.

Introduction

AppArmor 4.1 is a major new release of the AppArmor user space that makes several important changes to policy development and support. Its focus is transitioning policy to the new policy features.

Apprmor 4.1 is a stable release for the newer AppArmor 4 style policy which introduces several new features that are not backwards compatible. As such AppArmor 4.1 will be a long term support release.

This version of the userspace should work with all kernel versions from 2.6.15 and later (some earlier version of the kernel if they have the apparmor patches applied). And supports features released in the 4.20 kernel.

Note: that while older kernels are supported, not all features available in AppArmor 4.1 policy can be enforced on older kernels.

The kernel portion of the project is maintained and pushed separately.

Highlighted new features

• priority rule modifier

Important Notes

• gitlab release tarballs: Differ from the launchpad release tarballs. The launchpad release tarball has a couple processing steps already performed:
  • libapparmor autogen.sh is already done, meaning distros only need to use ./configure in their build setup
  • the docs for everything but libapparmor have already been built
• Potentially breaking changes:

Known Issues

• qrt change_hat regression tests fail when using perms32

• utils do not handle priorities in rules
• utils do not handle leading permissions
• mount rules
  • handling of conflicting mount options is not backwards compatible

Obtaining the Release

There are two ways to obtain this release either through gitlab or a tarball in launchpad. Important note: the gitlab release tarballs: Differ from the launchpad release tarballs. The launchpad release tarball has a couple processing steps already performed:

• libapparmor autogen.sh is already done, meaning distros only need to use ./configure in their build setup
• the docs for everything but libapparmor have already been built

gitlab release

• https://gitlab.com/apparmor/apparmor/-/releases/v4.1.0

Launchpad Tarball

• https://launchpad.net/apparmor/4.1/4.1/+download/apparmor-4.1.0.tar.gz
• sha256sum: ???
• signature: https://launchpad.net/apparmor/4.1/4.1/+download/apparmor-4.1.0.tar.gz.asc

Changes since AppArmor 4.0???

Misc

• apparmor.vim
  • add missing units for rlimit cpu and rttime (MR:1336)
  • add missing units for rlimit cpu and rttime (MR:1336)
  • add missing units for rlimit cpu and rttime (MR:1336)
• aa-remove-unknown
  • fix readability check (MR:1438, HUBMR:285915, HUB:273164)
  • fix readability check (MR:1438, HUBMR:285915, HUB:273164)
• aa-status
  • fix json generation (MR:1451, AABUG:470)
  • replace uses of which for command -v for POSIX compatibility and to fix running the test suite on openSUSE Tumbleweed (MR:1431)
  • fix awk not being found on openSuse 15.6 (MR:1431)

policy compiler (aka apparmor_parser)

• add port range support on network policy (MR:1321)

Policy

profiles

unconfined profiles

• new

Documentation

Regression Tests

Changes in this Release

These release notes cover all changes between 4.0??? ( ???) and 4.1.0 ( ??? ) apparmor-4.1 branch.

General improvements

New Profile Flags

???

New Mediation rules

Policy Compiler (a.k.a apparmor_parser)

• add port range support on network policy (MR:1321)
• fix mapping of AA_CONT_MATCH for policydb compat entries (MR:1409, AABUG:462)
• improve profile build and dump info
  • add the abilitiy to dump the permissions table (MR:1410)
  • add the accept2 table entry to the chfa dump (MR:1410)
  • fix and cleanup libapparmor_re/Makefile (MR:1410)
• restore MatchFlag dump from being hex encoded to decimal (MR:1419)
• fix make setup when bison is not installed by quoting BISON_MAJOR (MR:1431)
• replace uses of MS_SYNC by MS_SYNCHRONOUS in mount flags (MR:1458)
• add separator between mount flags in dump_flags (MR:1465)
• allow make-* flags with remount operations (MR:1466, LP:2091424)
• convert uint to unsigned int (MR:1478)
• fix rule priority destroying rule permissions for io_uring and userns classes (MR:1307)
• fix integer overflow bug in rule priority comparisons (MR:1396, AABUG:452)
• fix minimization check for filtering deny (MR:1396, AABUG:452)
• fix memory leak in aare_rules UniquePermsCache (MR:1399)
• fix do not change auditing information when applying deny (MR:1408, AABUG:461)

Library

• bug fix do not change auditing information when applying deny (MR:1408, AABUG:461)
• fix af_protos.h generation so it's consistent between different architectures (MR:1309)
• fix ABI break for aa_log_record (MR:1345, LP:2083435)

Utils

• improve UX when allowing rules in aa-notify and update the man page (MR:1313)
• store the child profile/hat name if we are in a child profile or hat instead of the main profile (MR:1359)
• aa-mergeprof: prevent backtrace if file not found (MR:1403)

• fix creation of path /usr/share/polkit-1/actions/ in python tools setup to create intermediary directories (MR:1306)
• improve UX when allowing rules in aa-notify and update the man page (MR:1313)
• store the child profile/hat name if we are in a child profile or hat instead of the main profile (MR:1359)
• aa-mergeprof: prevent backtrace if file not found (MR:1403)
• Remove match statements in utils for older Python compatibility (MR:1440)
• fixes/workarounds for python 3.13 missing cgitb (MR:1439, AABUG:447)
• fix E502 error on Python 3.11 (MR:1431)
• limit buildpath.py setuptools version check to the relevant bits (MR:1460)
• fix tools to ignore peer when parsing logs for non-peer access modes (MR:1314, AABUG:427)
• fix exception when replacing owner file, rules by file, by suggesting mrwlkix instead (MR:1320, AABUG:429)
• fix wrong order of the owner keyword when cleaning file rules (MR:1320, AABUG:430)
• fix thrown TypeError exception when passing binary logs to the tools (MR:1354, AABUG:436)

Policy

abstractions

• mesa: allow ~/.cache/mesa_shader_cache_db/ (MR:1333, LP:2081692)
• nameservice-strict: add more strict version of abstractions/nameservice
• nameservice:
  • support name resolution via libnss-libvirt (MR:1362)
  • include abstractions/nameservice-strict (MR:1373)
  • tighten libnss_libvirt file access (MR:1379)
• dconf: use @{etc_ro} instead of /etc/... r, (MR:1402)

• dconf
  • use @{etc_ro} instead of /etc/... r, (MR:1402)
  • allow write access to /run/user/*/dconf/user (MR:1471)
• mesa
  • allow ~/.cache/mesa_shader_cache_db/ (MR:1333, LP:2081692)
• nameservice
  • support name resolution via libnss-libvirt (MR:1362)
  • include abstractions/nameservice-strict (MR:1373)
  • tighten libnss_libvirt file access (MR:1379)
• nameservice-strict
  • add more strict version of abstractions/nameservice
• php
  • add support for ArchLinux php-legacy package to php-fpm (MR:1401, AABUG:454)
• python
  • allow python cache under @{HOME}/.cache/ (MR:1467)

profiles

• slirp4netns: allow pivot_root (MR:1298, HUB:348)
• php-fpm:
  • confine php-fpm in both /usr/bin and /usr/sbin (MR:1301, AABUG:421)
  • add support for ArchLinux php-legacy package ( MR:1401, AABUG:454, LP:2061113)
  • widen allowed socket paths (MR:1406, LP:2061113)
• ping: allow reading /proc/sys/net/ipv6/conf/all/disable_ipv6 (MR:1340, debug1082190)
• transmission: add attach_disconnected flag (MR:1355, LP:2083548)
• zgrep: deny reading /etc/nsswitch.conf and /etc/passwd (MR:1361)
• support /usr/libexec/postfix/ path (MR:1330):
  • postfix-anvil
  • postfix-bounce
  • postfix-cleanup
  • postfix-discard
  • postfix-dnsblog
  • postfix-error
  • postfix-flush
  • postfix-lmtp
  • postfix-local
  • postfix-master
  • postfix-nqmgr
  • postfix-oqmgr
  • postfix-pickup
  • postfix-pipe
  • postfix-postscreen
  • postfix-proxymap
  • postfix-qmgr
  • postfix-qmqpd
  • postfix-scache
  • postfix-showq
  • postfix-smtp
  • postfix-smtpd
  • postfix-spawn
  • postfix-tlsmgr
  • postfix-trivial-rewrite
  • postfix-verify
  • postfix-virtual
  • usr.sbin.postqueue
  • usr.sbin.sendmail
  • usr.sbin.sendmail.postfix
• postfix-master: add exec perm for postfix-tlsproxy and postscreen (MR:1330)
• postfix-postscreen: add abstractions/{nameservice,postfix-common} and cache map (MR:1330)
• postfix-smtpd: add permissions to rwk /{var/spool/postfix/,}pid/pass.smtpd (MR:1330)
• postfix-tlsproxy: add new profile (MR:1330)

• php-fpm:

  • confine php-fpm in both /usr/bin and /usr/sbin (MR:1301, AABUG:421)

  • add support for ArchLinux php-legacy package to php-fpm (MR:1401, AABUG:454)

  • widen allowed socket paths (MR:1406, LP:2061113)

  • add support for ArchLinux php-legacy package ( MR:1401, AABUG:454, LP:2061113)

• ping
  • allow reading /proc/sys/net/ipv6/conf/all/disable_ipv6 (MR:1340, debug1082190)
• Postfix
  • Support /usr/libexec/postfix/ path (MR:1330)
    • postfix-anvil
    • postfix-bounce
    • postfix-cleanup
    • postfix-discard
    • postfix-dnsblog
    • postfix-error
    • postfix-flush
    • postfix-lmtp
    • postfix-local
    • postfix-master
    • postfix-nqmgr
    • postfix-oqmgr
    • postfix-pickup
    • postfix-pipe
    • postfix-postscreen
    • postfix-proxymap
    • postfix-qmgr
    • postfix-qmqpd
    • postfix-scache
    • postfix-showq
    • postfix-smtp
    • postfix-smtpd
    • postfix-spawn
    • postfix-tlsmgr
    • postfix-trivial-rewrite
    • postfix-verify
    • postfix-virtual
    • usr.sbin.postqueue
    • usr.sbin.sendmail
    • usr.sbin.sendmail.postfix
• postfix-master
  • add exec perm for postfix-tlsproxy and postscreen (MR:1330)
• postfix-postscreen
  • add abstractions/{nameservice,postfix-common} and cache map (MR:1330)
• postfix-showq
  • Allow reading queue ID files from /var/spool/postfix/hold/ (MR:1454)
• postfix-smtpd
  • add permissions to rwk /{var/spool/postfix/,}pid/pass.smtpd (MR:1330)
  • allow locking for /var/spool/postfix/pid/unix.relay (MR:1459)
• postfix-tlsproxy
  • add new profile (MR:1330)
• slirp4netns: allow pivot_root (MR:1298, HUB:348)
• transmission
  • add attach_disconnected flag (MR:1355, LP:2083548)
• smbd:
  • allow capability chown (MR:1456, BOS:1234327)
• zgrep
  • deny reading /etc/nsswitch.conf and /etc/passwd (MR:1361)
• dovecot:
  • allow reading /proc/sys/kernel/core_pattern (MR:1331)
• bwrap:
  • update the bwrap profile so that it will attach to application profiles if present (MR:1435)
• transmission-gtk:
  • add attach_disconnected flag (MR:1395, LP:2085377)
• cupsd:
  • allow /etc/paperspecs read access (MR:1472)
  • convert profile to use @etc_ro/rw (MR:1472)

unconfined profiles

Documentation

Translations

• sync translation from launchpad

Infrastructure

Tests

• Regression:
  • fix compiler warnings in fd_inheritance.c and pivot_root.c of the regression test suite (MR:1407)
  • resolve some compiler warnings (MR:1407)
  • fix regression tests when parent directory contains spaces (MR:1418, MR:1424)
  • fix incorrect setfattr call in xattrs_profile (MR:1429)
  • add complain mode regression tests (MR:1415)
  • check if setfattr exists to run xattr_profile tests (MR:1412)
  • fix mult_mount and file_unbindable_mount tests by using a larger loop device (MR:1431, MR:1469)
  • add DAC permissions check to the test suite (MR:1411)
  • fix swap regression tests on zfs and btrfs (MR:1462, MR:1463, MR:1464)
  • fix test infrastructure when a wrapper is specified (MR:1450)
  • add test mediation for file access in unbindable mounts (MR:1448)
• test-logprof
  • Increase test timeout (MR:1417, AABUG:463)
• spread
  • add support for spread tests (MR:1432)
  • add support for local kernel (MR:1452)
  • add regression tests for snapd mount-control (MR:1445)
• equality
  • fix equality tests for priority (MR:1455)
  • add explicit test for parser priority-based carveouts (MR:1443)

Bug Fixes

• fix creation of path /usr/share/polkit-1/actions/ in python tools setup to create intermediary directories (MR:1306)
• fix af_protos.h generation so it's consistent between different architectures (MR:1309)
• fix rule priority destroying rule permissions for io_uring and userns classes (MR:1307)
• fix tools to ignore peer when parsing logs for non-peer access modes (MR:1314, AABUG:427)
• fix exception when replacing owner file, rules by file, by suggesting mrwlkix instead (MR:1320, AABUG:429)
• fix wrong order of the owner keyword when cleaning file rules (MR:1320, AABUG:430)
• fix ABI break for aa_log_record (MR:1345, LP:2083435)
• fix thrown TypeError exception when passing binary logs to the tools (MR:1354, AABUG:436)
• fix integer overflow bug in rule priority comparisons (MR:1396, AABUG:452)
• fix minimization check for filtering deny (MR:1396 , AABUG:452)
• fix memory leak in aare_rules UniquePermsCache (MR:1399)
• fix compiler warnings in fd_inheritance.c and pivot_root.c of the regression test suite MR:1407
• fix do not change auditing information when applying deny (MR:1408, AABUG:461)

• fix creation of path /usr/share/polkit-1/actions/ in python tools setup to create intermediary directories (MR:1306)
• fix af_protos.h generation so it's consistent between different architectures (MR:1309)
• fix rule priority destroying rule permissions for io_uring and userns classes (MR:1307)
• fix tools to ignore peer when parsing logs for non-peer access modes (MR:1314, AABUG:427)
• fix exception when replacing owner file, rules by file, by suggesting mrwlkix instead (MR:1320, AABUG:429)
• fix wrong order of the owner keyword when cleaning file rules (MR:1320, AABUG:430)
• fix ABI break for aa_log_record (MR:1345, LP:2083435)
• fix thrown TypeError exception when passing binary logs to the tools (MR:1354, AABUG:436)
• fix integer overflow bug in rule priority comparisons (MR:1396, AABUG:452)
• fix minimization check for filtering deny (MR:1396, AABUG:452)
• fix memory leak in aare_rules UniquePermsCache (MR:1399)
• fix compiler warnings in fd_inheritance.c and pivot_root.c of the regression test suite (MR:1407)
• fix do not change auditing information when applying deny (MR:1408, AABUG:461)
• fix mapping of AA_CONT_MATCH for policydb compat entries (MR:1409, AABUG:462)
• bug fix do not change auditing information when applying deny (MR:1408, AABUG:461)
• fix equality tests for priority (MR:1455)
• fix awk not being found on openSuse 15.6 (MR:1431)
• fix json generation on aa-status (MR:1451, AABUG:470)
• fix make setup when bison is not installed by quoting BISON_MAJOR (MR:1431)

Feature Matrix

??????

The feature matrix provides an overview of which features/changes are supported on which release and or kernel.

Feature	policy extension	breaks 3.x	supported by utils	requires 4.x libapparmor	requires kernel support
unconfined flag	Y	Y 1	N	N	Y 2
debug flag	Y	Y 1	N	N	Y 2
prompt flag	Y	Y 1	N	N	Y 2
audit.mode flag	Y	Y 1	N	N	Y 2
kill.signal flag	Y	Y 1	N	N	Y 2
attach_disconnected.path flag	Y	Y 1	N	N	Y 2
default_allow	Y	Y 1	N	N	N
all rule	Y	Y 1	N	N	N
userns	Y	Y 1	N	N	Y 2
rootless apparmor_parser	N	N	n/a	N	N
improved -O rule-merge	N	N	n/a	N	N
aa-status filters	N	N	n/a	N	N
aa-load	N	N	n/a	Y	N
io_uring	Y	Y 1	N	N	Y 2
port level network 12	Y	Y 1	N	N	Y 2
unconfined ns restriction	N	Y 8	n/a	N	Y
unconfined change_profile stacking	N	Y 8	n/a	N	Y
unconfined io_uring restriction	N	Y 8	n/a	N	Y

1. If present in policy will cause previous versions of AppArmor to fail
2. Requires kernel support, policy can be downgraded to work on kernels that do not support.
3. Previous versions of AppArmor may not fail but will not behave correctly
4. Feature can be functionally provided by may not be exactly the same
5. If more than 12 transitions are used in a profile, AppArmor 3.x will fail
6. Will break older policy if variable is not defined. Variable can be manually defined in older parser.
7. AppArmor 3.x will not break but will use declared abi, instead of extending abi when a rule not in the abi is declared in policy.
8. These features if enabled will change unconfined's behavior but can be disabled with either a grub kernel boot parameter or sysctl depending on the kernel.
9. Does not allow any new rules but allows overlapping exec rules that would have been previously rejected.
10. If overlapping rules not supported by 3.x are used policy will break on 3.x and older environments
11. Tools will work but may not deal with overlapping rules correctly in some cases
12. Experimental