[apparmor] [Bug 793505] Re: apparmor not work with kernel 2.6.38 or 2.6.39 with ubuntu

[John Johansen]

AppArmor will work with the 2.6.38 and 2.6.39 kernels however it has
some limitations because the upstream kernel is missing certain patches
(AppArmor 2.4 compatibility patch).

The parser is detecting that the loaded kernel is missing certain features and reporting that to warn you.
The effect of the missing patches are the following
- policy can be loaded, replaced, and removed but it can't be fully introspected
  - this means the initscript based reload, and stop will not work but manual apparmor_parser replacement and removal will work
  - aa-status will not work
  - ps -Z will work
- Network rules are not enforced

Until the new introspection interface (which is being worked on), and
networking patches are accepted upstream, unpatched upstream kernels
will unfortunately have these issues.


** Changed in: apparmor
   Importance: Undecided => Wishlist

** Changed in: apparmor
       Status: New => In Progress

** Changed in: apparmor
       Status: In Progress => Won't Fix

-- 
You received this bug notification because you are a member of AppArmor
Developers, which is the registrant for AppArmor.
https://bugs.launchpad.net/bugs/793505

Title:
  apparmor not work with kernel 2.6.38 or 2.6.39 with ubuntu

Status in AppArmor Linux application security framework:
  Won't Fix

Bug description:
  I have ubuntu maverick and try to compile the new stable kernel fro
  kernel.org but at the boot there is a problem with apparmor that i
  can't fix. I attach the /var/log/boot.log

  * Starting AppArmor profiles        Cache read/write disabled:
  /sys/kernel/security/apparmor/features interface file missing. (Kernel
  needs AppArmor 2.4 compatibility patch.)

  Cache read/write disabled: /sys/kernel/security/apparmor/features
  interface file missing. (Kernel needs AppArmor 2.4 compatibility
  patch.)

  Warning from /etc/apparmor.d/gdm-guest-session (/etc/apparmor.d/gdm-
  guest-session line 48): profile /usr/share/gdm/guest-session/Xsession
  network rules not enforced

  Cache read/write disabled: /sys/kernel/security/apparmor/features
  interface file missing. (Kernel needs AppArmor 2.4 compatibility
  patch.)

  Warning from /etc/apparmor.d/sbin.dhclient3
  (/etc/apparmor.d/sbin.dhclient3 line 73): profile /sbin/dhclient3
  network rules not enforced

  Cache read/write disabled: /sys/kernel/security/apparmor/features
  interface file missing. (Kernel needs AppArmor 2.4 compatibility
  patch.)

  Skipping profile in /etc/apparmor.d/disable: usr.bin.firefox

  Cache read/write disabled: /sys/kernel/security/apparmor/features
  interface file missing. (Kernel needs AppArmor 2.4 compatibility
  patch.)

  Warning from /etc/apparmor.d/usr.sbin.cupsd
  (/etc/apparmor.d/usr.sbin.cupsd line 165): profile
  /usr/lib/cups/backend/cups-pdf network rules not enforced

  Warning from /etc/apparmor.d/usr.sbin.cupsd
  (/etc/apparmor.d/usr.sbin.cupsd line 165): profile /usr/sbin/cupsd
  network rules not enforced

  Cache read/write disabled: /sys/kernel/security/apparmor/features
  interface file missing. (Kernel needs AppArmor 2.4 compatibility
  patch.)

  Warning from /etc/apparmor.d/usr.sbin.tcpdump
  (/etc/apparmor.d/usr.sbin.tcpdump line 51): profile /usr/sbin/tcpdump
  network rules not enforced

  
  I tried to update apparmor at the version 2.6 without solving