Security update for apparmor SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:0969-1 Final 1 1 2017-04-10T10:00:08Z current 2017-04-10T10:00:08Z 2017-04-10T10:00:08Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apparmor This update for apparmor fixes the following issues: These security issues were fixed: - CVE-2017-6507: Preserve unknown profiles when reloading apparmor.service (lp#1668892, boo#1029696) - boo#1017260: Migration to apparmor.service accidently disable AppArmor. Note: This will re-enable AppArmor if it was disabled by the last update. You'll need to 'rcapparmor reload' to actually load the profiles, and then check aa-status for programs that need to be restarted to apply the profiles. These non-security issues were fixed: - Fixed crash in aa-logprof on specific change_hat events - boo#1016259: Added var.mount dependeny to apparmor.service The aa-remove-unknown utility was added to unload unknown profiles (lp#1668892) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2017-04/msg00011.html E-Mail link for openSUSE-SU-2017:0969-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.1 openSUSE Leap 42.2 apache2-mod_apparmor-2.10.2-12.3.1 apparmor-2.10.2-12.3.1 apparmor-abstractions-2.10.2-12.3.1 apparmor-docs-2.10.2-12.3.1 apparmor-parser-2.10.2-12.3.1 apparmor-parser-lang-2.10.2-12.3.1 apparmor-profiles-2.10.2-12.3.1 apparmor-utils-2.10.2-12.3.1 apparmor-utils-lang-2.10.2-12.3.1 libapparmor-devel-2.10.2-12.3.1 libapparmor1-2.10.2-12.3.1 libapparmor1-32bit-2.10.2-12.3.1 pam_apparmor-2.10.2-12.3.1 pam_apparmor-32bit-2.10.2-12.3.1 perl-apparmor-2.10.2-12.3.1 python3-apparmor-2.10.2-12.3.1 ruby-apparmor-2.10.2-12.3.1 apache2-mod_apparmor-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 apparmor-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 apparmor-abstractions-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 apparmor-docs-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 apparmor-parser-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 apparmor-parser-lang-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 apparmor-profiles-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 apparmor-utils-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 apparmor-utils-lang-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 libapparmor-devel-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 libapparmor1-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 libapparmor1-32bit-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 pam_apparmor-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 pam_apparmor-32bit-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 perl-apparmor-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 python3-apparmor-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 ruby-apparmor-2.10.2-12.3.1 as a component of openSUSE Leap 42.1 apache2-mod_apparmor-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 apparmor-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 apparmor-abstractions-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 apparmor-docs-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 apparmor-parser-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 apparmor-parser-lang-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 apparmor-profiles-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 apparmor-utils-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 apparmor-utils-lang-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 libapparmor-devel-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 libapparmor1-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 libapparmor1-32bit-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 pam_apparmor-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 pam_apparmor-32bit-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 perl-apparmor-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 python3-apparmor-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 ruby-apparmor-2.10.2-12.3.1 as a component of openSUSE Leap 42.2 An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due to the common logic to handle 'restart' operations removing AppArmor profiles that aren't found in the typical filesystem locations, such as /etc/apparmor.d/. Userspace projects that manage their own AppArmor profiles in atypical directories, such as what's done by LXD and Docker, are affected by this flaw in the AppArmor init script logic. CVE-2017-6507 openSUSE Leap 42.1:apache2-mod_apparmor-2.10.2-12.3.1 openSUSE Leap 42.1:apparmor-2.10.2-12.3.1 openSUSE Leap 42.1:apparmor-abstractions-2.10.2-12.3.1 openSUSE Leap 42.1:apparmor-docs-2.10.2-12.3.1 openSUSE Leap 42.1:apparmor-parser-2.10.2-12.3.1 openSUSE Leap 42.1:apparmor-parser-lang-2.10.2-12.3.1 openSUSE Leap 42.1:apparmor-profiles-2.10.2-12.3.1 openSUSE Leap 42.1:apparmor-utils-2.10.2-12.3.1 openSUSE Leap 42.1:apparmor-utils-lang-2.10.2-12.3.1 openSUSE Leap 42.1:libapparmor-devel-2.10.2-12.3.1 openSUSE Leap 42.1:libapparmor1-2.10.2-12.3.1 openSUSE Leap 42.1:libapparmor1-32bit-2.10.2-12.3.1 openSUSE Leap 42.1:pam_apparmor-2.10.2-12.3.1 openSUSE Leap 42.1:pam_apparmor-32bit-2.10.2-12.3.1 openSUSE Leap 42.1:perl-apparmor-2.10.2-12.3.1 openSUSE Leap 42.1:python3-apparmor-2.10.2-12.3.1 openSUSE Leap 42.1:ruby-apparmor-2.10.2-12.3.1 openSUSE Leap 42.2:apache2-mod_apparmor-2.10.2-12.3.1 openSUSE Leap 42.2:apparmor-2.10.2-12.3.1 openSUSE Leap 42.2:apparmor-abstractions-2.10.2-12.3.1 openSUSE Leap 42.2:apparmor-docs-2.10.2-12.3.1 openSUSE Leap 42.2:apparmor-parser-2.10.2-12.3.1 openSUSE Leap 42.2:apparmor-parser-lang-2.10.2-12.3.1 openSUSE Leap 42.2:apparmor-profiles-2.10.2-12.3.1 openSUSE Leap 42.2:apparmor-utils-2.10.2-12.3.1 openSUSE Leap 42.2:apparmor-utils-lang-2.10.2-12.3.1 openSUSE Leap 42.2:libapparmor-devel-2.10.2-12.3.1 openSUSE Leap 42.2:libapparmor1-2.10.2-12.3.1 openSUSE Leap 42.2:libapparmor1-32bit-2.10.2-12.3.1 openSUSE Leap 42.2:pam_apparmor-2.10.2-12.3.1 openSUSE Leap 42.2:pam_apparmor-32bit-2.10.2-12.3.1 openSUSE Leap 42.2:perl-apparmor-2.10.2-12.3.1 openSUSE Leap 42.2:python3-apparmor-2.10.2-12.3.1 openSUSE Leap 42.2:ruby-apparmor-2.10.2-12.3.1 moderate 4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-04/msg00011.html https://www.suse.com/security/cve/CVE-2017-6507.html CVE-2017-6507 https://bugzilla.suse.com/1029696 SUSE Bug 1029696