<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt'>
<p>Hi Steve/Rodrigo/pkg-apparmor-team, </p>
<p><img src="cid:e2a37ac54b5a555ce4bc71e47817a760@sonic.net" /></p>
<p>Does it typically take 6 months for a Debian package update that addresses a CVE to make its way downstream to a machine with Linux Mint installed?</p>
<p>That seems very slow to me, but maybe I am misunderstanding the processes involved...</p>
<p>I recently learned about the OpenSSF Scorecard project (<a class="status-link unhandled-link" title="https://scorecard.dev/" translate="no" href="https://scorecard.dev/" target="_blank" rel="nofollow noopener noreferrer"><span class="invisible">https://</span><span class="">scorecard.dev/</span><span class="invisible"></span></a>) from the Open Source Security podcast (<a href="https://opensourcesecurity.io/">https://opensourcesecurity.io/</a>). It is now on version 5.0 - <a class="status-link unhandled-link" title="https://github.com/ossf/scorecard" translate="no" href="https://github.com/ossf/scorecard" target="_blank" rel="nofollow noopener noreferrer"><span class="invisible">https://</span><span class="">github.com/ossf/scorecard</span></a></p>
<p>Would that help automate some checks and speed up the testing process?</p>
<p><br /></p>
<div>---<br />
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">Thanks, <br /> <br /> Brad - <a href="https://www.facebook.com/brad.morrison.12327/" target="_blank" rel="noopener noreferrer">https://www.facebook.com/brad.morrison.12327/</a> & <a href="https://norcal.social/@BradMorrison" target="_blank" rel="noopener noreferrer">https://norcal.social/@BradMorrison</a></div>
</div>
<p><br /></p>
<p>On 2024-09-19 14:34, Steve Beattie wrote:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">Hi Brad,<br /> <br /> On Tue, Sep 17, 2024 at 03:26:37AM -0700, Brad Morrison wrote:
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">I am running Linux Mint 21.3 with the Cinnamon desktop environment -<br /> <a href="https://www.linuxmint.com/edition.php?id=311" target="_blank" rel="noopener noreferrer">https://www.linuxmint.com/edition.php?id=311</a> <br /> <br /> An update to Apparmor came across the Linux Mint 21.3 Update Manager<br /> today, updating the package from old version "3.0.4-2ubuntu2.3build2"<br /> to new version "3.0.4-2ubuntu2.4" but the new version was dated "Tue, 06<br /> Mar 2024" in the changelog that lists <a href="mailto:rodrigo.zaiden@canonical.com">rodrigo.zaiden@canonical.com</a> as<br /> the maintainer. <br /> <br /> Here is a screenshot of how that update looks in the Linux Mint 21.3<br /> Update Manager - <a href="https://paste.opensuse.org/pastes/5b207dca03d3" target="_blank" rel="noopener noreferrer">https://paste.opensuse.org/pastes/5b207dca03d3</a> (expires<br /> in 1 week) <br /> <br /> Why would this significant security & package update take 6 months to be<br /> pushed through to my machine?</blockquote>
<br /> Linux Mint 21.3 is derived from and based on Ubuntu 22.04 LTS. The<br /> update to apparmor was just published to that release this week:<br /> <br /> <a href="https://launchpad.net/ubuntu/+source/apparmor/3.0.4-2ubuntu2.4" target="_blank" rel="noopener noreferrer">https://launchpad.net/ubuntu/+source/apparmor/3.0.4-2ubuntu2.4</a><br /> <br /> The specific issue, CVE-2016-1585, being addressed here is that<br /> the apparmor policy generated around mount rules was in some cases<br /> less restrictive than intended. The result of fixing this is that<br /> for users with mount rules in their apparmor policy, the update<br /> might cause some of their application to fail due to the more tight<br /> restrictions. Many applications that might be confined by apparmor<br /> don't need the ability to perform mount operations, but things like<br /> container managers (docker, k8s, lxd) might, and thus could need<br /> their policy adjusted after applying the update to not break them.<br /> <br /> Because of this, while the update was originally prepared several<br /> months ago, in Ubuntu, we published it in a testing pocket (called<br /> "proposed"[<a href="https://wiki.ubuntu.com/Testing/EnableProposed" target="_blank" rel="noopener noreferrer">1</a>] in the Ubuntu ecosystem) to allow people to test the<br /> update in their environment, and it is only now that we are moving<br /> it to the updates and security pockets. This is why you haven't seen<br /> it in Linux Mint until now.<br /> <br /> More information on the update is available from:<br /> <br /> <a href="https://discourse.ubuntu.com/t/upcoming-apparmor-security-update-for-cve-2016-1585/" target="_blank" rel="noopener noreferrer">https://discourse.ubuntu.com/t/upcoming-apparmor-security-update-for-cve-2016-1585/</a><br /> <a href="https://bugs.launchpad.net/apparmor/+bug/1597017" target="_blank" rel="noopener noreferrer">https://bugs.launchpad.net/apparmor/+bug/1597017</a><br /> <br /> As an aside, the pkg-apparmor list is a primarily focused on apparmor<br /> packaging in Debian.<br /> <br /> Thanks!<br /> <br />
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">Other resources I browsed while discussing this issue on the Linux Mint<br /> IRC - <a href="https://manpages.ubuntu.com/manpages/jammy/en/man7/apparmor.7.html" target="_blank" rel="noopener noreferrer">https://manpages.ubuntu.com/manpages/jammy/en/man7/apparmor.7.html</a><br /> & <a href="https://packages.ubuntu.com/jammy/apparmor" target="_blank" rel="noopener noreferrer">https://packages.ubuntu.com/jammy/apparmor</a> & <a href="https://apparmor.net/" target="_blank" rel="noopener noreferrer">https://apparmor.net/</a></blockquote>
<br /> [1] <a href="https://wiki.ubuntu.com/Testing/EnableProposed" target="_blank" rel="noopener noreferrer">https://wiki.ubuntu.com/Testing/EnableProposed</a></div>
<br />
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">_______________________________________________<br /> pkg-apparmor-team mailing list<br /> <a href="mailto:pkg-apparmor-team@alioth-lists.debian.net">pkg-apparmor-team@alioth-lists.debian.net</a><br /> <a href="https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-apparmor-team" target="_blank" rel="noopener noreferrer">https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-apparmor-team</a></div>
</blockquote>
</body></html>