From intrigeri at debian.org  Thu Oct 29 09:13:19 2026
From: intrigeri at debian.org (intrigeri)
Date: Thu, 29 Oct 2026 10:13:19 +0100
Subject: [Pkg-swan-devel] Please get your packages ready for AppArmor 5.0
In-Reply-To: <notmuch-sha1-9eba05efba9d4eae88259a476d9d641220640bf9>
Message-ID: <874ie4x428.fsf@manticora>

Hi,

As announced last month, I plan to upload apparmor 5.0.x to sid today.

What I wrote last month regarding the need for testing and potentially
profiles updates is still relevant:

intrigeri (2026-09-17):
> tl;dr: please test the packages you maintain, that ship AppArmor
> policy, on tesitng/sid with apparmor 5.0.x from experimental.
>
> You're receiving this email because you are in the Maintainer field
> for at least 1 package that ships files in /etc/apparmor.d/.
>
> Forky will ship with the AppArmor 5.0.x userspace. Together with
> Forky's kernel, this enables finer grained confinement rules than what
> we had in Trixie.
>
> The main changes are:
>
>  - Fine-grained D-Bus confinement: in Trixie, any D-Bus rule would be
>    silently upgraded to "allow any D-Bus operation" (which in many
>    cases is a sandbox escape); while in Forky, fine-grained rules will
>    be honored, and any D-Bus operation that's not explicitly allowed
>    will be denied.
>
>  - Unix socket rules and network rules: I'm not sure about the details
>    but I understand the situation is similar to D-Bus.
>
> So there's a chance the policy you ship in your packages will become
> more restrictive on Forky, which may break functionality.
>
> To make the transition smoother, please test the packages you maintain
> that ship AppArmor policy, on a testing/sid system, with apparmor
> 5.0.x from experimental, and ensure the policy you ship is compatible.
>
> Usually you can upload to sid any required policy update: most of the
> changes you'll have to do will be no-op's there until the apparmor
> 5.0.x userspace is in sid. And uploading the fixes early makes life
> easier for other folks who are using the apparmor 5.0.x userspace
> from experimental.
>
> I intend to upload apparmor 5.0.x to sid no earlier than October 26.

Thank you!
-- 
intrigeri


From intrigeri at debian.org  Thu Oct 29 11:07:19 2026
From: intrigeri at debian.org (intrigeri)
Date: Thu, 29 Oct 2026 12:07:19 +0100
Subject: [Pkg-swan-devel] [pkg-apparmor] Please get your packages ready
 for AppArmor 5.0
In-Reply-To: <874ie4x428.fsf@manticora>
References: <874ie4x428.fsf@manticora>
Message-ID: <87qzh8vk7s.fsf@manticora>

Hi again,

It was brought to my attention (thanks again!) that it could be hard
to figure out which package of yours is impacted, so here's a dd-list:

Adam Majer <adamm at zombino.com>
   isc-kea (U)

Amin Bandali <bandali at ubuntu.com>
   evince (U)

Andrea Bolognani <eof at kiyuko.org>
   libvirt (U)

Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
   clamav (U)

Andreas Hasenack <panlinux at gmail.com>
   isc-kea (U)

Antonio Terceiro <terceiro at debian.org>
   lxc (U)

Arnaud Ferraris <aferraris at debian.org>
   papers (U)

Athos Ribeiro <athos.ribeiro at canonical.com>
   isc-kea (U)

Athos Ribeiro <athos at debian.org>
   isc-kea (U)

Bernhard Schmidt <berni at debian.org>
   bind9 (U)

Boian Bonev <bbonev at ipacct.com>
   gpsd

Boyuan Yang <byang at debian.org>
   font-manager (U)

Bruno "Fuddl" Kleinert <fuddl at debian.org>
   ioquake3 (U)

Changwoo Ryu <cwryu at debian.org>
   ibus-hangul (U)

Chris Knadle <Chris.Knadle at coredump.us>
   aprx (U)

ClamAV Team <pkg-clamav-devel at lists.alioth.debian.org>
   clamav

Colin Watson <cjwatson at debian.org>
   man-db

Daniel Baumann <daniel at debian.org>
   haveged
   openvpn-auth-oauth2

Dave Hibberd <hibby at debian.org>
   aprx (U)

Debian AppArmor Team <pkg-apparmor-team at lists.alioth.debian.org>
   apparmor

Debian DNS Team <team+dns at tracker.debian.org>
   bind9

Debian Fonts Task Force <debian-fonts at lists.debian.org>
   font-manager

Debian Games Team <pkg-games-devel at lists.alioth.debian.org>
   ioquake3
   iortcw

Debian GNOME Extras Maintainers <pkg-gnome-extras-maintainers at lists.alioth.debian.org>
   evince

Debian GNOME Maintainers <pkg-gnome-maintainers at lists.alioth.debian.org>
   evince
   papers

Debian Hamradio Maintainers <debian-hams at lists.debian.org>
   aprx

Debian Input Method Team <debian-input-method at lists.debian.org>
   ibus-hangul

Debian KDE Extras Team <pkg-kde-extras at lists.alioth.debian.org>
   quassel

Debian Libvirt Maintainers <pkg-libvirt-maintainers at lists.alioth.debian.org>
   libvirt

Debian MySQL Maintainers <pkg-mysql-maint at lists.alioth.debian.org>
   mariadb
   mysql-9.7

Debian Printing Team <debian-printing at lists.debian.org>
   cups
   cups-filters

Debian Privacy Tools Maintainers <pkg-privacy-maintainers at lists.alioth.debian.org>
   torbrowser-launcher

Debian Qt/KDE Maintainers <debian-qt-kde at lists.debian.org>
   akonadi

Debian Remote Maintainers <debian-remote at lists.debian.org>
   lightdm-remote-session-x2go

Debian Scheme Team <debian-scheme at lists.debian.org>
   guix

Debian Security Tools <team+pkg-security at tracker.debian.org>
   tcpdump

Debian SSSD Team <pkg-sssd-devel at alioth-lists.debian.net>
   sssd

Debian SSSD Team <sssd at packages.debian.org>
   sssd

Debian Telepathy maintainers <pkg-telepathy-maintainers at lists.alioth.debian.org>
   telepathy-mission-control-5

Debian UBports Team <team+ubports at tracker.debian.org>
   lomiri-addressbook-app
   lomiri-content-hub
   lomiri-download-manager
   lomiri-gallery-app
   lomiri-url-dispatcher
   mediascanner2
   telepathy-ofono

Debian Xfce Maintainers <debian-xfce at lists.debian.org>
   lightdm

Dominic Hargreaves <dom at earth.li>
   anope

Dominik George <natureshadow at debian.org>
   sssd (U)

Emmanuel Bouthenot <kolter at debian.org>
   msmtp

Evgeni Golov <evgeni at debian.org>
   lxc (U)

Filippo Giunchedi <filippo at debian.org>
   inspircd

Guido G?nther <agx at sigxcpu.org>
   libvirt (U)

Hilko Bengen <bengen at debian.org>
   guestfs-tools

intrigeri <intrigeri at debian.org>
   apparmor (U)

Jason Guy <jason.e.guy at gmail.com>
   isc-kea (U)

Jeremy B?cha <jbicha at ubuntu.com>
   evince (U)
   papers (U)

Kea <isc-kea at packages.debian.org>
   isc-kea

Lars Tangvald <lars.tangvald at oracle.com>
   mysql-9.7 (U)

Laurent Bigonville <bigon at debian.org>
   evince (U)
   geoclue-2.0
   papers (U)
   telepathy-mission-control-5 (U)

Lena Voytek <lena at debian.org>
   mysql-9.7 (U)

Luigi Gangitano <luigi at debian.org>
   squid

Marco Trevisan (Trevi?o) <marco at ubuntu.com>
   evince (U)
   papers (U)

Marius Gripsgard <mariogrip at debian.org>
   lomiri-download-manager (U)
   lomiri-url-dispatcher (U)

Marius Gripsgard <marius at debian.org>
   mediascanner2 (U)

Marius Gripsgard <marius at ubports.com>
   lomiri-gallery-app (U)

Martin Pitt <mpitt at debian.org>
   cockpit (U)

Martin-?ric Racine <martin-eric.racine at iki.fi>
   openntpd

Mathias Gibbens <gibmat at debian.org>
   lxc (U)

Michael Biebl <biebl at debian.org>
   cockpit (U)

Michael Hudson-Doyle <mwhudson at debian.org>
   snapd
   snapd (U)

Michael Meskes <meskes at debian.org>
   clamav (U)

Michael Tautschnig <mt at debian.org>
   clamav (U)

Michael Tokarev <mjt at tls.msk.ru>
   unbound (U)

Michael Vogt <mvo at debian.org>
   snapd (U)

Mike Gabriel <sunweaver at debian.org>
   lightdm-remote-session-x2go (U)
   lomiri-addressbook-app (U)
   lomiri-content-hub (U)
   lomiri-download-manager (U)
   lomiri-gallery-app (U)
   lomiri-url-dispatcher (U)
   mediascanner2 (U)
   telepathy-ofono (U)

nicoo <nicoo at debian.org>
   haveged (U)
   redshift

Nobuhiro Iwamatsu <iwamatsu at debian.org>
   mozc

Ond?ej Sur? <ondrej at debian.org>
   bind9 (U)
   isc-kea (U)

Osamu Aoki <osamu at debian.org>
   ibus-hangul (U)

Otto Kek?l?inen <otto at debian.org>
   mariadb (U)

Paride Legovini <paride at debian.org>
   isc-kea (U)

Patrick Franz <deltaone at debian.org>
   akonadi (U)

Peter Palfrader <weasel at debian.org>
   tor

Pierre-Elliott B?cue <peb at debian.org>
   lxc (U)

pkg-lxc <pkg-lxc-devel at lists.alioth.debian.org>
   lxc

Reiner Herrmann <reiner at reiner-h.de>
   firejail
   surf

Richard Laager <rlaager at debian.org>
   ntpsec

Robert Edmonds <edmonds at debian.org>
   unbound (U)

Roger Shimizu <rosh at debian.org>
   torbrowser-launcher (U)

Roland Rosenfeld <roland at debian.org>
   privoxy

Ryan Kavanagh <rak at debian.org>
   openiked

Sandro Knau? <hefee at debian.org>
   akonadi (U)

Santiago Garcia Mantinan <manty at debian.org>
   squid (U)

Scott Kitterman <scott at kitterman.com>
   clamav (U)
   quassel (U)

Sebastian Andrzej Siewior <sebastian at breakpoint.cc>
   clamav (U)

Simon McVittie <smcv at debian.org>
   ioquake3 (U)
   iortcw (U)

Sjoerd Simons <sjoerd at debian.org>
   telepathy-mission-control-5 (U)

Stefano Brivio <sbrivio at redhat.com>
   passt

strongSwan Maintainers <pkg-swan-devel at lists.alioth.debian.org>
   strongswan

Sune Vuorela <debian at pusling.com>
   akonadi (U)

Thomas Ward <teward at ubuntu.com>
   torbrowser-launcher (U)

Thorsten Alteholz <debian at alteholz.de>
   cups (U)
   cups-filters (U)
   pollen

Till Kamppeter <till.kamppeter at gmail.com>
   cups (U)
   cups-filters (U)

Timo Aaltonen <tjaalton at debian.org>
   sssd (U)

Tobias Heider <me at tobhe.de>
   openiked (U)

Ulises Vitulli <dererk at debian.org>
   openntpd

unbound packagers <unbound at packages.debian.org>
   unbound

Unbound Packagers <unbound at packages.debian.org>
   unbound

Utopia Maintenance Team <pkg-utopia-maintainers at lists.alioth.debian.org>
   cockpit

Vagrant Cascadian <vagrant at debian.org>
   guix
   guix (U)

Vincent Blut <vincent.debian at free.fr>
   chrony

Yangfl <mmyangfl at gmail.com>
   i2pd
   qtox

Yves-Alexis Perez <corsac at debian.org>
   lightdm (U)
   strongswan (U)

Zygmunt Krynicki <me at zygoon.pl>
   snapd
   snapd (U)


Cheers,
-- 
intrigeri