PRO security isolation: apt_news #2794
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Jira: This PR is not related to a Jira item. (The PR title does not include a SC-#### reference) GitHub Issues: No GitHub issues are fixed by this PR. (No commits have Fixes: #### references) Launchpad Bugs: No Launchpad bugs are fixed by this PR. (No commits have LP: #### references) Documentation: The changes in this PR do not require documentation changes. 👍 this comment to confirm that this is correct. |
panlinux
force-pushed
the
ua-security-isolation-upstream
branch
6 times, most recently
from
539fc07
to
b1ee21c
Compare
panlinux
force-pushed
the
ua-security-isolation-upstream
branch
12 times, most recently
from
fb1c46f
to
f9befe3
Compare
panlinux
force-pushed
the
ua-security-isolation-upstream
branch
5 times, most recently
from
77caeda
to
676ab8e
Compare
panlinux
force-pushed
the
ua-security-isolation-upstream
branch
6 times, most recently
from
1362117
to
53fc62c
Compare
…pt_news to ubuntu_pro_apt_news
|
So, the #!/usr/bin/python3
import mock
import shutil
@mock.patch("os.path.isfile", return_value=True)
@mock.patch("builtins.open")
def mycopy(_fopen, m_isfile):
shutil.copy("/doesnotexist", "/tmp")
mycopy() |
panlinux
force-pushed
the
ua-security-isolation-upstream
branch
from
431faf9
to
433afa4
Compare
panlinux
force-pushed
the
ua-security-isolation-upstream
branch
from
433afa4
to
4869695
Compare
|
I updated |
|
Documentation PR: #2906 |
lucasmoura
reviewed
Jan 3, 2024
|
bionic started failing out of the blue. Did something in the bionic esm environment around this test change? |
Most or all of the settings are defined there, and since that module doesn't import anything, this also avoids potential future dependencies.
panlinux
force-pushed
the
ua-security-isolation-upstream
branch
from
5590710
to
77b4d75
Compare
|
Mantic failure: Can't diagnose because we have no logs, which is because of #2902 |
|
bionic is the same failure as #2794 (comment), which is supposed to be fixed by #2897 according to #2794 (comment) |
|
@lucasmoura I added a new function to gather the apparmor logs, which also creates an |
lucasmoura
approved these changes
Jan 4, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Why is this needed?
This is part of JIRA SD-1277 which aims to enable security features to existing Pro systemd services. The goal is to provide reasonable AppAmor and systemd security isolation configuration for the Pro systemd services.
There are multiple services to be tackled, and this PR is about apt-news.service, and tracked via JIRA SD-1450
Test Steps
This change relies mostly on the integration tests, but it can also be superficially tested manually.
Install
ubuntu-advantage-tools, and runapt-get update.. Observedmesg -wTand confirm there are no apparmor DENIED messages tied to the profileubuntu_advantage_apt_news, and that the apt-news service performs normally.Checklist
Does this PR require extra reviews?
Unsure, thinking.