Differences between revisions 24 and 25
Revision 24 as of 2014-03-26 10:05:46
Size: 2479
Editor: ?IntRigeri
Comment: Pidgin profile was merged upstream.
Revision 25 as of 2014-03-26 10:42:55
Size: 2408
Editor: ?IntRigeri
Comment: Pidgin profile imported into apparmor-profiles-extra
Deletions are marked like this. Additions are marked like this.
Line 9: Line 9:
 * DebianPts:pidgin => merged upstream; we can now include it into apparmor-profiles-extra
Line 17: Line 16:
 * DebianPts:pidgin

This page tracks progress of adding AppArmor profiles to Debian.

In progress

Profiles being worked on

Pending maintainer upload

Pending upload of apparmor-profiles-extra

Wishlist bug filed

See the bugs tagged "new-profile".

To be done

  • Supported profiles in Ubuntu main => import into apparmor-profiles-extra, unless the respective maintainers want to take it into their package. Maybe start with the high-profile services like Apache, OpenLDAP, ClamAV and Bind.

  • iceweasel => adapt Ubuntu's Firefox profile, or start over from intrigeri's current iceweasel profile

  • isc-dhcp-client => profile needs to be loaded before the network is up => see systemd item below

  • ntp, rsyslog => profile needs to be loaded before the service is started => see systemd item below

  • libvirt => libvirt 1.2.1-1 is built with AppArmor support (725144), but more work is probably needed. Felix Geyer volunteered to maintain the profiles.

  • Help get more profiles into good shape, so that they can be integrated upstream or into apparmor-profiles-extra. The Ubuntu security team roadmap tells a bit about their priority, and the current status of profiles under development.

  • Integrate with systemd by: waiting for systemd v210+, which has a ?ApparmorProfile= option, or ship upstart's /lib/init/apparmor-profile-load as an apparmor helper script and call it in systemd's ?ExecPreStart=

Done (for Jessie, at least)

Included in the corresponding package

Included in the apparmor-profiles package

The Community supported profiles are included in the apparmor-profiles package in complain mode.