committing changes in /etc made by "apt-get upgrade"

author mhoellein <mario@hoellein.online>

Tue, 16 Jul 2024 07:53:32 +0000 (09:53 +0200)

committer mhoellein <mario@hoellein.online>

Tue, 16 Jul 2024 07:53:32 +0000 (09:53 +0200)
author mhoellein <mario@hoellein.online>
Tue, 16 Jul 2024 07:53:32 +0000 (09:53 +0200)
committer mhoellein <mario@hoellein.online>
Tue, 16 Jul 2024 07:53:32 +0000 (09:53 +0200)
diff --git a/.etckeeper b/.etckeeper

index bf312557daa7f81d63d41a3c9118adf896a58202..a006110403fc673c56d8a23eb691d6b367c3be29 100755 (executable)
--- a/.etckeeper
+++ b/.etckeeper
@@ -66,6 +66,7 @@ mkdir -p './ssh/ssh_config.d'
  mkdir -p './ssh/sshd_config.d'
  mkdir -p './systemd/network'
  mkdir -p './udev/hwdb.d'
+mkdir -p './ufw/applications.d/apache2'
  mkdir -p './vulkan/explicit_layer.d'
  mkdir -p './vulkan/icd.d'
  mkdir -p './vulkan/implicit_layer.d'
@@ -638,6 +639,7 @@ maybe chmod 0644 'apparmor.d/local/lsb_release'
  maybe chmod 0644 'apparmor.d/local/nvidia_modprobe'
  maybe chmod 0644 'apparmor.d/local/sbin.dhclient'
  maybe chmod 0644 'apparmor.d/local/ubuntu_pro_apt_news'
+maybe chmod 0644 'apparmor.d/local/ubuntu_pro_esm_cache'
  maybe chmod 0644 'apparmor.d/local/usr.bin.freshclam'
  maybe chmod 0644 'apparmor.d/local/usr.bin.man'
  maybe chmod 0644 'apparmor.d/local/usr.lib.ipsec.charon'
@@ -672,6 +674,7 @@ maybe chmod 0644 'apparmor.d/tunables/xdg-user-dirs'
  maybe chmod 0755 'apparmor.d/tunables/xdg-user-dirs.d'
  maybe chmod 0644 'apparmor.d/tunables/xdg-user-dirs.d/site.local'
  maybe chmod 0644 'apparmor.d/ubuntu_pro_apt_news'
+maybe chmod 0644 'apparmor.d/ubuntu_pro_esm_cache'
  maybe chmod 0644 'apparmor.d/usr.bin.freshclam'
  maybe chmod 0644 'apparmor.d/usr.bin.man'
  maybe chmod 0644 'apparmor.d/usr.lib.ipsec.charon'
@@ -21780,6 +21783,7 @@ maybe chmod 0640 'ufw/after.init'
  maybe chmod 0640 'ufw/after.rules'
  maybe chmod 0640 'ufw/after6.rules'
  maybe chmod 0755 'ufw/applications.d'
+maybe chmod 0755 'ufw/applications.d/apache2'
  maybe chmod 0644 'ufw/applications.d/apache2-utils.ufw.profile'
  maybe chmod 0644 'ufw/applications.d/bind9'
  maybe chmod 0644 'ufw/applications.d/dovecot-imapd'
diff --git a/apparmor.d/local/ubuntu_pro_esm_cache b/apparmor.d/local/ubuntu_pro_esm_cache

new file mode 100644 (file)

index 0000000..e69de29
diff --git a/apparmor.d/ubuntu_pro_apt_news b/apparmor.d/ubuntu_pro_apt_news

index 402d939304ac785c90d5a3ac8e4670a47ae11843..d703d4a41c81d0780d1fec010dd08e08313517b5 100644 (file)
--- a/apparmor.d/ubuntu_pro_apt_news
+++ b/apparmor.d/ubuntu_pro_apt_news
@@ -1,6 +1,9 @@
  
  include <tunables/global>
  
+# attach_disconnected is needed here because this service runs with systemd's
+# PrivateTmp=true
+
  profile ubuntu_pro_apt_news flags=(attach_disconnected) {
    include <abstractions/base>
    include <abstractions/nameservice>
@@ -12,18 +15,24 @@ profile ubuntu_pro_apt_news flags=(attach_disconnected) {
    capability setgid,
    capability setuid,
    capability dac_read_search,
+  # GH: 3079
+  capability dac_override,
  
    /etc/apt/** r,
    /etc/default/apport r,
    /etc/ubuntu-advantage/* r,
-  /usr/bin/python3.{1,}[0-9] mrix,
+  # GH: #3109
+  # Allow reading the os-release file (possibly a symlink to /usr/lib).
+  /{etc/,usr/lib/,lib/}os-release r,
  
+  /{,usr/}bin/python3.{1,}[0-9] mrix,
    # "import uuid" in focal triggers an uname call
-  /usr/bin/uname mrix,
+  # And also see LP: #2067319
+  /{,usr/}bin/uname mrix,
  
-  /usr/lib/apt/methods/http mrix,
-  /usr/lib/apt/methods/https mrix,
-  /usr/lib/ubuntu-advantage/apt_news.py r,
+  /{,usr/}lib/apt/methods/http mrix,
+  /{,usr/}lib/apt/methods/https mrix,
+  /{,usr/}lib/ubuntu-advantage/apt_news.py r,
    /usr/share/dpkg/* r,
    /var/log/ubuntu-advantage.log rw,
    /var/lib/ubuntu-advantage/** r,
@@ -35,7 +44,11 @@ profile ubuntu_pro_apt_news flags=(attach_disconnected) {
    /tmp/** r,
  
    owner @{PROC}/@{pid}/fd/ r,
+  @{PROC}/@{pid}/status r,
    @{PROC}/@{pid}/cgroup r,
  
  
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/ubuntu_pro_apt_news>
  }
 \ No newline at end of file
diff --git a/apparmor.d/ubuntu_pro_esm_cache b/apparmor.d/ubuntu_pro_esm_cache

new file mode 100644 (file)

index 0000000..a117dbf
--- /dev/null
+++ b/apparmor.d/ubuntu_pro_esm_cache
@@ -0,0 +1,298 @@
+
+include <tunables/global>
+
+# attach_disconnected is needed in all profiles defined here because this
+# service runs with systemd's PrivateTmp=true
+
+profile ubuntu_pro_esm_cache flags=(attach_disconnected) {
+  include <abstractions/base>
+  include <abstractions/nameservice>
+  include <abstractions/openssl>
+  include <abstractions/python>
+  include <abstractions/user-tmp>
+
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability kill,
+  capability setgid,
+  capability setuid,
+
+  signal send set=int peer=ubuntu_pro_esm_cache//apt_methods,
+  signal send set=int peer=ubuntu_pro_esm_cache//apt_methods_gpgv,
+
+  /etc/apt/** r,
+  /etc/machine-id r,
+  /etc/ubuntu-advantage/uaclient.conf r,
+  # GH: #3109
+  # Allow reading the os-release file (possibly a symlink to /usr/lib).
+  /{etc/,usr/lib/,lib/}os-release r,
+
+  /run/ubuntu-advantage/ rw,
+  /run/ubuntu-advantage/** rw,
+
+  /run/systemd/container/ r,
+  /run/systemd/container/** r,
+
+  /{,usr/}bin/apt mrix,
+  /{,usr/}bin/apt-cache mrix,
+  /{,usr/}bin/ischroot mrix,
+  /{,usr/}bin/python3.{1,}[0-9] mrix,
+  # LP: #2067319
+  /{,usr/}bin/uname mrix,
+
+  /{,usr/}bin/cloud-id Cx -> cloud_id,
+  # LP: #2067319
+  /{,usr/}bin/ps Cx -> ps,
+  /{,usr/}bin/systemd-detect-virt Px -> ubuntu_pro_esm_cache_systemd_detect_virt,
+  /{,usr/}bin/dpkg Cx -> dpkg,
+  /{,usr/}bin/ubuntu-distro-info Cx -> ubuntu_distro_info,
+  /{,usr/}lib/apt/methods/gpgv Cx -> apt_methods_gpgv,
+  /{,usr/}lib/apt/methods/http Cx -> apt_methods,
+  /{,usr/}lib/apt/methods/https Cx -> apt_methods,
+  /{,usr/}lib/apt/methods/store Cx -> apt_methods,
+  # when there is no status.json cached, esm-cache.service will invoke "snap status"
+  /{,usr/}bin/snap PUx,
+
+  /usr/share/dpkg/** r,
+  /usr/share/keyrings/* r,
+
+  /var/cache/apt/** rw,
+
+  /var/lib/apt/** r,
+  /var/lib/dpkg/** r,
+  /var/lib/ubuntu-advantage/** rwk,
+
+  /var/log/ubuntu-advantage.log rw,
+
+  @{PROC}/@{pid}/fd/ r,
+  @{PROC}/1/cgroup r,
+  @{PROC}/version_signature r,
+  @{PROC}/@{pid}/mountinfo r,
+  @{PROC}/@{pid}/status r,
+  @{PROC}/@{pid}/stat r,
+  @{PROC}/sys/kernel/osrelease r,
+
+
+
+  profile ps flags=(attach_disconnected) {
+    include <abstractions/base>
+    include <abstractions/nameservice>
+
+    capability sys_ptrace,
+
+    # GH: #3079
+    capability dac_read_search,
+    capability dac_override,
+
+    # GH: #3119
+    ptrace (read,trace),
+
+    # LP: #2067319
+    /{,usr/}bin/ps mrix,
+
+    /dev/tty r,
+
+    @{PROC}/ r,
+    @{PROC}/@{pid}/** r,
+    @{PROC}/uptime r,
+    @{PROC}/sys/kernel/** r,
+    # GH: #3079
+    @{PROC}/tty/drivers r,
+    /sys/devices/system/node/ r,
+    /sys/devices/system/node/** r,
+  }
+
+  profile cloud_id flags=(attach_disconnected) {
+    include <abstractions/base>
+    include <abstractions/nameservice>
+    include <abstractions/python>
+
+    ptrace read peer=unconfined,
+
+    /etc/cloud/** r,
+    /etc/apt/** r,
+    /etc/apport/** r,
+    /etc/ssl/openssl.cnf r,
+
+    @{PROC}/@{pid}/fd/ r,
+    @{PROC}/cmdline r,
+    @{PROC}/1/environ r,
+    @{PROC}/1/cmdline r,
+    @{PROC}/@{pid}/status r,
+
+    /run/cloud-init/** r,
+
+    /{,usr/}bin/ r,
+    /{,usr/}bin/cloud-id r,
+    /{,usr/}bin/python3.{1,}[0-9] mrix,
+    # LP: #2067319
+    /{,usr/}bin/uname mrix,
+
+    /usr/share/dpkg/** r,
+
+    # workarounds for
+    # https://gitlab.com/apparmor/apparmor/-/issues/346
+    # LP: #2067319
+    /{,usr/}bin/systemctl Px -> ubuntu_pro_esm_cache_systemctl,
+    /{,usr/}bin/systemd-detect-virt Px -> ubuntu_pro_esm_cache_systemd_detect_virt,
+
+    /var/lib/cloud/** r,
+
+
+
+  }
+
+  profile dpkg flags=(attach_disconnected) {
+    include <abstractions/base>
+
+    capability setgid,
+
+    /etc/dpkg/** r,
+
+    /{,usr/}bin/dpkg mr,
+
+    # LP: #2067810
+    /var/lib/dpkg/** r,
+
+  }
+
+  profile ubuntu_distro_info flags=(attach_disconnected) {
+    include <abstractions/base>
+
+    /{,usr/}bin/ubuntu-distro-info mr,
+
+    /usr/share/distro-info/** r,
+
+  }
+
+  profile apt_methods flags=(attach_disconnected) {
+    include <abstractions/base>
+    include <abstractions/nameservice>
+    include <abstractions/ssl_certs>
+    include <abstractions/user-tmp>
+
+    capability setgid,
+    capability setuid,
+
+    network inet stream,
+    network inet6 stream,
+
+    signal receive set=int peer=ubuntu_pro_esm_cache,
+
+    / r,
+    /etc/dpkg/** r,
+
+    /{,usr/}lib/apt/methods/gpgv mr,
+    /{,usr/}lib/apt/methods/http mr,
+    /{,usr/}lib/apt/methods/https mr,
+    /{,usr/}lib/apt/methods/store mr,
+
+    /usr/share/dpkg/** r,
+
+    # LP: #2067810
+    /var/lib/dpkg/** r,
+
+    /var/lib/ubuntu-advantage/apt-esm/** rwk,
+
+    @{PROC}/@{pid}/cgroup r,
+    @{PROC}/@{pid}/fd/ r,
+
+  }
+
+  profile apt_methods_gpgv flags=(attach_disconnected) {
+    include <abstractions/base>
+    include <abstractions/nameservice>
+    include <abstractions/ssl_certs>
+    include <abstractions/user-tmp>
+
+    capability setgid,
+    capability setuid,
+
+    signal receive set=int peer=ubuntu_pro_esm_cache,
+
+    / r,
+    /etc/dpkg/** r,
+
+    # there are just too many shell script tools that are called, like head,
+    # tail, cut, sed, etc
+    /{,usr/}bin/* mrix,
+
+    /{,usr/}lib/apt/methods/gpgv mr,
+
+    /usr/share/dpkg/** r,
+    /usr/share/keyrings/* r,
+
+    /var/lib/ubuntu-advantage/apt-esm/** r,
+
+    @{PROC}/@{pid}/fd/ r,
+
+    # apt-config command needs these
+    # Note: observed only in xenial tests, but makes sense for all releases
+    /etc/apt/** r,
+    /var/lib/apt/** r,
+
+    # LP: #2067810
+    /var/lib/dpkg/** r,
+
+  }
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/ubuntu_pro_esm_cache>
+}
+
+  # these profiles were initially subprofiles of cloud-id, but:
+  # a) that crashes the kernel
+  # https://gitlab.com/apparmor/apparmor/-/issues/346
+  # b) <= bionic doesn't like the // or - chars in profile names
+  # https://gitlab.com/apparmor/apparmor/-/commit/99755daafb8cfde4df542b66f656597a482129ac
+
+  profile ubuntu_pro_esm_cache_systemctl flags=(attach_disconnected) {
+    include <abstractions/base>
+
+    capability net_admin,
+    capability sys_ptrace,
+
+    ptrace read peer=unconfined,
+
+
+
+    # LP: #2067319
+    /{,usr/}bin/systemctl mr,
+
+    /run/systemd/private rw,
+    /run/systemd/** r,
+
+    @{PROC}/cmdline r,
+    # GH: #3119
+    @{PROC}/1/* r,
+    @{PROC}/@{pid}/stat r,
+    @{PROC}/sys/kernel/osrelease r,
+    # GH: 3119
+    /sys/firmware/efi/efivars/** r,
+  }
+
+  profile ubuntu_pro_esm_cache_systemd_detect_virt flags=(attach_disconnected) {
+    include <abstractions/base>
+
+    capability sys_ptrace,
+
+    ptrace read peer=unconfined,
+
+    /{,usr/}bin/systemd-detect-virt mr,
+
+    /run/systemd/** r,
+
+    /sys/devices/virtual/** r,
+    # GH: #3119
+    /sys/firmware/efi/efivars/** r,
+    @{PROC}/@{pid}/status r,
+    @{PROC}/@{pid}/stat r,
+    @{PROC}/1/environ r,
+    @{PROC}/1/sched r,
+    @{PROC}/cmdline r,
+    @{PROC}/1/cmdline r,
+    @{PROC}/sys/kernel/osrelease r,
+
+  }
+\ No newline at end of file
diff --git a/coolwsd/coolkitconfig.xcu b/coolwsd/coolkitconfig.xcu

index 828ef6b4d6fd1141d443e052a54adc3f181135cd..61e39faa0586ae27a5e2e0b9b5e1432b65510455 100644 (file)
--- a/coolwsd/coolkitconfig.xcu
+++ b/coolwsd/coolkitconfig.xcu
@@ -417,7 +417,7 @@
          </node>
          <node oor:name="FontColor">
              <prop oor:name="Color" oor:op="fuse">
-                <value>0</value>
+                <value>0xFFFFFF</value>
              </prop>
          </node>
          <node oor:name="Links">
diff --git a/mysql/FROZEN b/mysql/FROZEN

new file mode 120000 (symlink)

index 0000000..2bc63ae
--- /dev/null
+++ b/mysql/FROZEN
@@ -0,0 +1 @@
+../../usr/share/doc/mysql-common/frozen-mode/downgrade
+\ No newline at end of file
author	mhoellein <mario@hoellein.online>
	Tue, 16 Jul 2024 07:53:32 +0000 (09:53 +0200)
committer	mhoellein <mario@hoellein.online>
	Tue, 16 Jul 2024 07:53:32 +0000 (09:53 +0200)
.etckeeper		patch \| blob \| history
apparmor.d/local/ubuntu_pro_esm_cache	[new file with mode: 0644]	patch \| blob
apparmor.d/ubuntu_pro_apt_news		patch \| blob \| history
apparmor.d/ubuntu_pro_esm_cache	[new file with mode: 0644]	patch \| blob
coolwsd/coolkitconfig.xcu		patch \| blob \| history
mysql/FROZEN	[new symlink]	patch \| blob