Bug 46628 - apparmor: Multiple issues (4.3)
apparmor: Multiple issues (4.3)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.3
All Linux
: P5 normal (vote)
: UCS 4.3-0-errata
Assigned To: Philipp Hahn
Arvid Requate
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-03-13 17:29 CET by Philipp Hahn
Modified: 2018-05-16 17:04 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 0.0 ()


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Philipp Hahn univentionstaff 2018-03-13 17:29:21 CET
New Debian apparmor 2.11.0-3+deb9u2 fixes:
This update addresses the following issue:
* Pin the AppArmor feature set to Stretch's kernel. This ensures Stretch
  systems, even when running a newer kernel (e.g. from backports), have their
  AppArmor feature set pinned to the one supported by the AppArmor policy
  shipped in Stretch. Otherwise they would experience breakage due to new
  AppArmor mediation features introduced in recent kernels.
Comment 1 Philipp Hahn univentionstaff 2018-03-13 17:38:15 CET
[4.3-0] 6d775034ff Bug #46628: apparmor_2.11.0-3+deb9u2
Comment 2 Quality Assurance univentionstaff 2018-05-04 16:43:36 CEST
--- mirror/ftp/4.3/unmaintained/4.3-0/source/apparmor_2.11.0-3.dsc
+++ apt/ucs_4.3-0-errata4.3-0/source/apparmor_2.11.0-3+deb9u2.dsc
@@ -1,3 +1,20 @@
+2.11.0-3+deb9u2 [Tue, 27 Feb 2018 10:59:06 +0000] intrigeri <intrigeri@debian.org>:
+
+  * Move the features file to /usr/share/apparmor-features;
+    accordingly remove the old (now obsolete) '/etc/apparmor/features'
+    conffile (Closes: #883682).
+  * Configure gbp for DEP-14 and avoid gbp-pq prefixing patches
+    with numbers.
+
+2.11.0-3+deb9u1 [Sat, 25 Nov 2017 18:04:05 +0000] intrigeri <intrigeri@debian.org>:
+
+  * Pin the AppArmor feature set to Stretch's kernel (Closes: #879585).
+    This ensures Stretch systems, even when running a newer kernel (e.g.
+    from backports), have their AppArmor feature set pinned to the one
+    supported by the AppArmor policy shipped in Stretch. Otherwise they
+    would experience breakage due to new AppArmor mediation features
+    introduced in recent kernels.
+
 2.11.0-3 [Tue, 28 Mar 2017 10:29:15 +0000] intrigeri <intrigeri@debian.org>:
 
   * Fix CVE-2017-6507: don't unload unknown profiles during package
Comment 3 Arvid Requate univentionstaff 2018-05-14 18:51:58 CEST
* No UCS specific patches
* Comparison to previously shipped version ok
* Binary package update Ok
* Advisory Ok
Comment 4 Arvid Requate univentionstaff 2018-05-16 17:04:05 CEST
<http://errata.software-univention.de/ucs/4.3/42.html>