Skip to content

apparmor: 4.0.3 -> 4.1.0, rewrite#400430

Merged
mweinelt merged 5 commits intoNixOS:stagingfrom
LordGrimmauld:apparmor-update
Apr 23, 2025
Merged

apparmor: 4.0.3 -> 4.1.0, rewrite#400430
mweinelt merged 5 commits intoNixOS:stagingfrom
LordGrimmauld:apparmor-update

Conversation

@LordGrimmauld
Copy link
Contributor

@LordGrimmauld LordGrimmauld commented Apr 21, 2025 •
edited
Loading

Upstream release: https://gitlab.com/apparmor/apparmor/-/releases/v4.1.0

Notable changes made to the packaging:

  • apparmor-kernel-patches: drop. This was outdated and unused, and wouldn't even apply to any kernel anymore.
  • aa-teardown: migrate to writeShellAPplication
  • apparmor-*: migrate to by-name
  • apparmor-*: enable checks and actually run checks
  • libapparmor: test python module imports correctly
  • libapparmor: no seperate $python output (makes no sense)

This should be basically compatible with any preexisting setup using apparmor. I tried my best to keep ABI.

Tested build types

  • pkgsCross.gnu64.libapparmor (aarch64-linux builder)
  • pkgsCross.gnu64.apparmor-* (aarch64-linux builder)
  • pkgsCross.aarch64-multiplatform.libapparmor (x86_64-linux builder)
  • pkgsMusl.libapparmor (x86_64-linux builder)
  • pkgsMusl.apparmor-* (x86_64-linux builder)
  • pkgsLLVM.libapparmor (x86_64-linux builder)

This does unbreak a couple cross builds that were previously broken.

Things done

  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
    • sandbox = relaxed
    • sandbox = true
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
  • Fits CONTRIBUTING.md.

Add a 👍 reaction to pull requests you find important.

@github-actions github-actions bot added 10.rebuild-darwin: 1-10 This PR causes between 1 and 10 packages to rebuild on Darwin. 10.rebuild-linux: 5001+ This PR causes many rebuilds on Linux and must target the staging branches. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. labels Apr 21, 2025
@grimmauld-bot
Copy link

grimmauld-bot commented Apr 21, 2025

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 400430 --package libapparmor --package dbus --package apparmor-parser --package apparmor-bin-utils --package nixosTests.apparmor --package apparmor-pam --package apparmor-teardown --package apparmor-utils --package systemd

aarch64-linux

✅ 1 test built:
  • nixosTests.apparmor
✅ 16 packages built:
  • apparmor-bin-utils
  • apparmor-pam
  • apparmor-parser
  • apparmor-teardown
  • apparmor-utils
  • dbus
  • dbus.debug (dbus.debug.debug, dbus.debug.dev, dbus.debug.doc, dbus.debug.lib, dbus.debug.man)
  • dbus.dev (dbus.dev.debug, dbus.dev.dev, dbus.dev.doc, dbus.dev.lib, dbus.dev.man)
  • dbus.doc (dbus.doc.debug, dbus.doc.dev, dbus.doc.doc, dbus.doc.lib, dbus.doc.man)
  • dbus.lib (dbus.lib.debug, dbus.lib.dev, dbus.lib.doc, dbus.lib.lib, dbus.lib.man)
  • dbus.man (dbus.man.debug, dbus.man.dev, dbus.man.doc, dbus.man.lib, dbus.man.man)
  • libapparmor
  • systemd
  • systemd.debug (systemd.debug.debug, systemd.debug.dev, systemd.debug.man)
  • systemd.dev (systemd.dev.debug, systemd.dev.dev, systemd.dev.man)
  • systemd.man (systemd.man.debug, systemd.man.dev, systemd.man.man)

@LordGrimmauld
Copy link
Contributor Author

LordGrimmauld commented Apr 21, 2025

@ofborg build libapparmor libapparmor.passthru.tests

@LordGrimmauld
Copy link
Contributor Author

LordGrimmauld commented Apr 21, 2025

@ofborg build libapparmor libapparmor.passthru.tests

@LordGrimmauld LordGrimmauld force-pushed the apparmor-update branch 5 times, most recently from 600b63d to b448118 Compare April 21, 2025 08:09
marcin-serwin
marcin-serwin requested changes Apr 21, 2025
View reviewed changes
marcin-serwin
marcin-serwin reviewed Apr 21, 2025
View reviewed changes
@LordGrimmauld

This comment was marked as resolved.

Sign in to view
LordGrimmauld
LordGrimmauld commented Apr 21, 2025
View reviewed changes
@LordGrimmauld LordGrimmauld force-pushed the apparmor-update branch 2 times, most recently from 41c3ccc to a0872d1 Compare April 21, 2025 10:25
@LordGrimmauld LordGrimmauld added the 11.by: package-maintainer This PR was created by a maintainer of all the package it changes. label Apr 21, 2025
@nixos-discourse
Copy link

nixos-discourse commented Apr 21, 2025

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/apparmor-on-nixos-roadmap/57217/18

@LordGrimmauld
Copy link
Contributor Author

LordGrimmauld commented Apr 21, 2025

@ofborg build libapparmor libapparmor.passthru.tests

@LordGrimmauld
Copy link
Contributor Author

LordGrimmauld commented Apr 21, 2025

The ofborg build is timing out, so i suppose the nixpkgs-review needs to suffice here

@nyabinary
Copy link
Contributor

nyabinary commented Apr 22, 2025

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 400430 --package nixosTests.apparmor --package libapparmor

x86_64-linux

❌ 1 package failed to build:
  • libapparmor
✅ 1 test built:
  • nixosTests.apparmor

@nyabinary
Copy link
Contributor

nyabinary commented Apr 22, 2025

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 400430 --package nixosTests.apparmor --package libapparmor

x86_64-linux

❌ 1 package failed to build:

* libapparmor

✅ 1 test built:

* nixosTests.apparmor

Failed because of a HTTP 404 (so safe to ignore)

@LordGrimmauld
Copy link
Contributor Author

LordGrimmauld commented Apr 22, 2025

I have just reported the parser test fails on musl upstream: https://gitlab.com/apparmor/apparmor/-/issues/513

@wegank wegank added the 12.approvals: 1 This PR was reviewed and approved by one person. label Apr 22, 2025
@github-actions github-actions bot added 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: module (update) This PR changes an existing module in `nixos/` labels Apr 22, 2025
@LordGrimmauld
Copy link
Contributor Author

LordGrimmauld commented Apr 22, 2025

While the parser on musl is still somewhat broken, it can't be correct to hard-code glibc here. Asking stdenv for the correct libc for logprof is (hopefully) a little less broken.

Replacing the parser with the musl based parser via overlay does still pass our VM test, so it is probably not completely broken.

@LordGrimmauld
Copy link
Contributor Author

LordGrimmauld commented Apr 22, 2025

https://gitlab.com/apparmor/apparmor/-/issues/513#note_2462939579

So while our parser tests are semi-broken, the VM tests do still pass with musl based parser. This is most likely less broken than it was before this PR. I am happy with this current state and would just say musl+apparmor users are on their own if they do end up running into edge cases with the parser here.

@LordGrimmauld
apparmor: 4.0.3 -> 4.1.0, rewrite
eba90bb 
Upstream release: https://gitlab.com/apparmor/apparmor/-/releases/v4.1.0

Notable changes made to the packaging:
- apparmor-kernel-patches: drop. This was outdated and unused, and wouldn't even apply to any kernel anymore.
- aa-teardown: migrate to writeShellAPplication
- apparmor-*: migrate to by-name
- apparmor-*: enable checks and actually run checks
- libapparmor: test python module imports correctly
- libapparmor: no seperate $python output (makes no sense)
@LordGrimmauld
nixos/apparmor: don't hardcode glibc for logprof
f8a3ea0
@github-actions github-actions bot added the 6.topic: teams Relating to team creation, updates, other management actions label Apr 22, 2025
@wegank wegank removed the 12.approvals: 1 This PR was reviewed and approved by one person. label Apr 23, 2025
@mweinelt mweinelt merged commit 65f179f into NixOS:staging Apr 23, 2025
27 of 29 checks passed
@Majiir Majiir mentioned this pull request May 10, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ju1m ju1m Awaiting requested review from ju1m

@prusnak prusnak Awaiting requested review from prusnak

@bjornfor bjornfor Awaiting requested review from bjornfor

@thoughtpolice thoughtpolice Awaiting requested review from thoughtpolice

@mweinelt mweinelt Awaiting requested review from mweinelt

@K900 K900 Awaiting requested review from K900

@marcin-serwin marcin-serwin Awaiting requested review from marcin-serwin

@nyabinary nyabinary Awaiting requested review from nyabinary

Assignees

No one assigned

Labels

6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 6.topic: teams Relating to team creation, updates, other management actions 8.has: module (update) This PR changes an existing module in `nixos/` 8.has: package (update) This PR updates a package to a newer version 10.rebuild-darwin: 1-10 This PR causes between 1 and 10 packages to rebuild on Darwin. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-linux: 5001+ This PR causes many rebuilds on Linux and must target the staging branches. 11.by: package-maintainer This PR was created by a maintainer of all the package it changes.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@LordGrimmauld @grimmauld-bot @nixos-discourse @nyabinary @marcin-serwin @mweinelt @wegank