apparmor (5.0.0~alpha1-0ubuntu8.3) questing; urgency=medium

  * This is an SRU, tracked in LP: #2130617
  * Add patch to grant netrc access to tnftp (LP: #2127491):
    - d/p/u/profiles-grant-netrc-read-access-to-tnftp.patch
  * Add patch to fix device tree scan by systemd-detect-virt (LP: #2127111)
    - d/p/u/profiles-systemd-detect-virt-handle-device-tree-folder.patch
  * Add patch to allow lsblk reading of Azure NVMe ACPI (LP: #2126920):
    - d/p/u/lsblk_read_access_azure_acpi.patch
  * Add patch to fix errors in regression tests with Rust coreutils
    (LP: #2129779):
    - d/p/u/regression-fix-for-rust-coreutils.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 20 Oct 2025 11:10:39 -0700

apparmor (5.0.0~alpha1-0ubuntu8.1) questing; urgency=medium

  * Add patch to fix Flatpak breakage caused by fusermount3 denials
    (LP: #2122161):
    - d/p/u/profiles-add-rules-to-fix-flatpaks-with-fuse3-17.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 09 Oct 2025 10:44:07 -0700

apparmor (5.0.0~alpha1-0ubuntu8) questing; urgency=medium

  * Add patch to allow technically invalid @{.,.} alternations in profiles
    (LP: #2126450):
    - d/p/u/parser-fix-unix-addresses-with-alternations.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Tue, 30 Sep 2025 11:06:26 -0700

apparmor (5.0.0~alpha1-0ubuntu7) questing; urgency=medium

  * Add profile patches to support both GNU and Rust coreutils
    (LP: #2122633, LP: #2123870):
    - d/p/u/profiles-tunables-add-coreutils-var.patch
    - d/p/u/profiles-use-coreutils-tunable.patch
  * Add patches to fix socketpair QRT test (LP: #2124206):
    - d/p/u/0001-tests-regression-Update-socketpair-test-for-upstream.patch
    - d/p/u/0002-tests-regression-update-socketpair-tests-to-detect-d.patch
    - d/p/u/0003-tests-regression-update-test-requires-for-v9-af_unix.patch
    - d/p/u/0004-tests-regressions-Improve-output-of-require_any_of_k.patch
    - d/p/u/0005-tests-regression-update-network-requirements-for-v9.patch
    - d/p/u/0006-regression-tests-update-logic-to-support-v9-af_unix-.patch
    - d/p/u/0007-tests-regressions-Fix-socket-pair-for-v7-semantics.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 15 Sep 2025 14:15:56 -0700

apparmor (5.0.0~alpha1-0ubuntu6) questing; urgency=medium

  * Add patches to fix nondeterministic profile builds (LP: #2122086):
    - d/p/u/parser_libapparmor_re_fix_inconsistent_build.patch
    - d/p/u/parser_libapparmor_re_fix_implied_m.patch
  * Add patch to add console access to more profiles (LP: #2122536):
    - d/p/u/profiles_add_more_consoles_workaround.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Tue, 09 Sep 2025 15:19:03 -0700

apparmor (5.0.0~alpha1-0ubuntu5) questing; urgency=medium

  * Add patch to disable the free profile (LP: #2121552):
    - d/p/u/profiles_disable_free.patch
  * Add patch to disable the curl profile (LP: #2121552):
    - d/p/u/profiles_disable_curl.patch
  * Add patch to add console access to the dig profile (LP: #2121401):
    - d/p/u/profiles_dig_add_abstractions_consoles.patch
  * Add patch to fix systemd-detect-virt new denials (LP: #2121248):
    - d/p/u/profiles_fix_systemd_detect_virt_new_denials.patch
  * Add patch to the libnuma abstraction for active usage (LP: #2122088):
    - d/p/u/profiles_expand_libnuma_abstraction.patch
  * Add patches to fix disconnected_mount_complain regression test on
    kernel 6.15 or later (LP: #2122087):
    - d/p/u/regression_disconnected_mount_complain_danglings.patch
    - d/p/u/regression_disconnected_mount_complain_fix_6_15.patch
  * Add patch to fix aa-show-usage test's handling of disabled profiles
    (LP: #2122089):
    - d/p/u/utils_test_aa_show_usage_handle_disabled.patch
  * Add patch for pam_extrausers.so usage in unix-chkpwd (LP: #2121875):
    - d/p/u/profiles-add-rules-for-pam-extrausers.so-to-unix-chkpwd.patch
  * apparmor.install, apparmor-profiles.install: move install lines for
    free and curl to apparmor-profiles
  * apparmor.maintscript: handle disabling of free and curl profiles
  * debian/tests/compile-policy, debian/tests/control: switch from ntp to
    chrony (LP: #2122143)

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 04 Sep 2025 12:24:37 -0700

apparmor (5.0.0~alpha1-0ubuntu4) questing; urgency=medium

  * Add a patch to grant curl read access to tmp (LP: #2119237):
    - d/p/u/curl_read_tmp.patch
  * Add a patch to grant curl access to a snapd socket (LP: #2120669):
    - d/p/u/curl_access_snapd_socket.patch
  * Add a patch to grant unix_chkpwd access to authd (LP: #2120221):
    - d/p/u/unix_chkpwd_authd.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 18 Aug 2025 17:07:46 -0700

apparmor (5.0.0~alpha1-0ubuntu3) questing; urgency=medium

  * debian/apparmor.install, debian/apparmor-profiles.install,
    debian/apparmor.maintscript: disable the lsof profile by default
    as temporary workaround for LP #2120233

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 11 Aug 2025 09:38:19 -0700

apparmor (5.0.0~alpha1-0ubuntu2) questing; urgency=medium

  * Add a patch to grant nss-systemd access to new GDM userdb service:
    (LP: #2119541)
    - d/p/u/nss-systemd-grant-access-to-gdb-user-db.patch
  * Add a patch to improve aa-notify command notification fallback:
    - d/p/u/aa-notify-fallback-to-ev-comm-when-ev-execpath.patch
  * Add patches to fix parser memory leaks:
    - d/p/u/parser-fix-misc-leaks.patch
    - d/p/u/parser-fix-more-parser-leaks.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 07 Aug 2025 18:07:17 -0700

apparmor (5.0.0~alpha1-0ubuntu1) questing; urgency=medium

  * New upstream release.
  * Add a patch to fix parser variable expansion:
    - d/p/u/parser-fix-variable-expansion.patch
  * Add patch to remove hwctl profile from our packaging:
    - d/p/u/profiles_remove_hwctl.patch
  * Updated patches to apply to the new release:
    - d/p/u/communitheme-snap-support.patch
    - d/p/u/parser-fix-pam_apparmor-regression-test-failures.patch
    - d/p/u/delete-the-busybox-and-nautilus-profiles.patch
  * Refreshed patches to apply to the new release:
    - d/p/u/profiles-grant-access-to-systemd-resolved.patch
    - d/p/u/aa-notify-userns-filtering.patch
  * Dropped patches that were superseded upstream:
    - d/p/u/lsblk_mr_1437.patch
    - d/p/u/lsusb_mr_1433.patch
    - d/p/u/lsusb_profile_fixup.patch
    - d/p/u/lsblk_sudo_and_tree.patch
    - d/p/u/remmina_mr_1348.patch
    - d/p/u/remmina-dbus-describeall.patch
    - d/p/u/rygel_mr_1311.patch
    - d/p/u/socat_mr_1319.patch
    - d/p/u/tnftp_mr_1363.patch
    - d/p/u/znc_mr_1376.patch
    - d/p/u/tshark_mr_1384.patch
    - d/p/u/wireguard_mr_1323.patch
    - d/p/u/netcat-openbsd_mr_1327.patch
    - d/p/u/tar_mr_1453.patch
    - d/p/u/tar_cap_fowner_fix_mr_1553.patch
    - d/p/u/alsamixer_mr_1517.patch
    - d/p/u/tinyproxy_mr_1477.patch
    - d/p/u/frr_mr_1380.patch
    - d/p/u/iotop_c_mr_1520.patch
    - d/p/u/wpa_supplicant_mr_1385.patch
    - d/p/u/wpa_supplicant_profile_fixup.patch
    - d/p/u/fusermount3_mr_1514.patch
    - d/p/u/curl_mr_1560.patch
  * Dropped patches that were applied upstream:
    - d/p/u/mbsync_mr_1372.patch
    - d/p/u/dnstracer_mr_1366.patch
    - d/p/u/mosquitto_mr_1506.patch
    - d/p/u/libapparmor-swig-perl-typemaps.patch
    - d/p/u/0001-utils-read_profiles-robust-against-unparseable.patch
    - d/p/u/0002-utils-test-minitools-resiliency-against-unparsed.patch
    - d/p/u/attach_disconnected_ipc.patch
    - d/p/u/profiles_ensure_access_to_attach_path.patch
    - d/p/u/fix-incorrect-mount-flag-apparmor.d-docs.patch
    - d/p/u/regression-verify-documented-mount-flag-behavior.patch
    - d/p/u/profiles-add-libnuma-abstraction.patch
  * d/apparmor.install:
    - Remove entry for toybox profile
    - Add entries for new profiles from upstream release
  * d/apparmor-profiles.install: ensure that the remmina profile
    remains disabled by default

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 31 Jul 2025 12:45:58 -0700

apparmor (4.1.1-0ubuntu6) questing; urgency=medium

  * Add a patch to add a libnuma abstraction (LP: #2117553)
    - d/p/u/profiles-add-libnuma-abstraction.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Wed, 23 Jul 2025 09:11:11 -0700

apparmor (4.1.1-0ubuntu5) questing; urgency=medium

  * d/apparmor.maintscript: remove ssh-keygen profile

 -- Nick Rosbrook <enr0n@ubuntu.com>  Tue, 15 Jul 2025 15:37:33 -0400

apparmor (4.1.1-0ubuntu4) questing; urgency=medium

  * d/p/ubuntu/ssh_keygen_mr_1519.patch: revert ssh-keygen profile
    This is breaking basic ssh-keygen functionality, and started quietly
    breaking various autopkgtests that rely on ssh-keygen (LP: #2116288)
  * d/control: Build-Depends: net-tools, for test_unconfined

 -- Nick Rosbrook <enr0n@ubuntu.com>  Thu, 10 Jul 2025 17:17:44 -0400

apparmor (4.1.1-0ubuntu3) questing; urgency=medium

  * d/p/u/lsblk_mr_1437.patch: merge other lsblk patches into this one:
    - d/p/u/lsblk_network_disk_fixup.patch
    - d/p/u/lsblk-s390-fixes.patch
    - d/p/u/lsblk_vbd.patch
  * Add a patch to fix lsblk and --tree (LP: #2110212):
    - d/p/u/lsblk_sudo_and_tree.patch
  * d/p/u/openvpn_mr_1263.patch: merge other openvpn patches into this one:
    - d/p/u/openvpn-systemd-notify.patch
    - d/p/u/openvpn-networkmanager-imports.patch
    - d/p/u/openvpn-permissive-paths.patch
    - d/p/u/openvpn_dnsfix.patch
  * d/p/u/iotop_c_mr_1520.patch: merge other iotop_c patch into this one:
    - d/p/u/profiles-give-iotop-c-additional-accesses.patch
  * d/p/u/fusermount3_mr_1514.patch: squash other fusermount3 patches:
    - d/p/u/fusermount3_profile_fixup.patch
    - d/p/u/fusermount3-flatpak-fixup.patch
    - d/p/u/fusermount3-mount-nested-subdirs-run-user.patch
    - d/p/u/fusermount3-Include-full-nameservice-rules-for-SSSD-users.patch
    - d/p/u/fusermount3_cvmfs.patch
    - d/p/u/fusermount3_allow_more_flags.patch
    - d/p/u/profiles-add-ix-permissions-for-mount-and-umount-on-.patch
    - d/p/u/profiles-add-mount-permissions-to-fusermount3-needed.patch
  * d/p/u/mbsync_mr_1372.patch: update patch for current upstream MR
  * Add patch to add new profiles that are not targeted for inclusion in
    a future upstream AppArmor 5.0:
    - d/p/u/curl_mr_1560.patch
    - d/p/u/ssh_keygen_mr_1519.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Fri, 13 Jun 2025 11:34:04 -0700

apparmor (4.1.1-0ubuntu2) questing; urgency=medium

  * Add patches to fix fusermount3 profile (LP: #2111845):
    - d/p/u/profiles-add-ix-permissions-for-mount-and-umount-on-.patch
    - d/p/u/profiles-add-mount-permissions-to-fusermount3-needed.patch

 -- Georgia Garcia <georgia.garcia@canonical.com>  Fri, 13 Jun 2025 08:39:45 -0300

apparmor (4.1.1-0ubuntu1) questing; urgency=medium

  * New upstream release.
  * Updated patches to apply to the new release:
    - d/p/u/tinyproxy_mr_1477.patch
    - d/p/u/0001-utils-read_profiles-robust-against-unparseable.patch
    - d/p/u/0002-utils-test-minitools-resiliency-against-unparsed.patch
    - d/p/u/attach_disconnected_ipc.patch
  * Refreshed patches to apply to the new release:
    - d/p/u/libapparmor-swig-perl-typemaps.patch
    - d/p/u/profiles-grant-access-to-systemd-resolved.patch
    - d/p/u/parser-fix-pam_apparmor-regression-test-failures.patch
  * Dropped patches that were applied upstream:
    - d/p/u/sbuild_mr_1555.patch
    - d/p/u/add-qt6-abstractions.patch
    - d/p/u/utils-fix-ignore-hotkey-conflict.patch
    - d/p/u/libapparmor-bump-patch-version-for-features-prefix.patch
    - d/p/u/utils-add-unprivileged_userns-to-aa-notify-list.patch
    - d/p/aa-notify-dont-merge-configs-with-confdir.patch
    - d/p/u/plasmashell-QtWebEngineProcess-new-path.patch
    - d/p/u/unprivileged_userns_rootdir.patch
    - d/p/u/parser-fix-handling-of-norelatime-mount-rule-flag.patch
  * Dropped patches that were superseded upstream:
    - d/p/u/utils-fix-mount-handling-hyphens.patch
    - d/p/u/utils-fix-profile-header-generation.patch
    - d/p/u/libapparmor-features-match-prefixes.patch
    - d/p/u/0003-utils-remove-the-skip_-_profiles-testing-bypass.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 09 Jun 2025 16:06:43 -0700

apparmor (4.1.0~beta5-0ubuntu16) questing; urgency=medium

  * d/p/u/fusermount3_allow_more_flags.patch: allow noexec flag on mount
    (LP: #2111807)
  * Add patch to give lsblk access to information about Xen vbd devices
    (LP: #2111604)
    - d/p/u/lsblk_vbd.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Tue, 27 May 2025 15:47:45 -0400

apparmor (4.1.0~beta5-0ubuntu15) questing; urgency=medium

  * Add patch to allow unprivileged_userns access to root dir
    (https://gitlab.com/apparmor/apparmor/-/issues/505):
    - d/p/u/unprivileged_userns_rootdir.patch
  * Add patch to fix lsblk accesses on IBM System Z systems (LP: #2107402)
    and execution from a confined context (LP: #2107455):
    - d/p/u/lsblk-s390-fixes.patch
  * Add patch to fix execution of various commands from confined contexts
    (https://gitlab.com/apparmor/apparmor/-/merge_requests/1637,
    backport of the profile fixes and logprof test fix):
    - d/p/u/profiles_ensure_access_to_attach_path.patch
  * Add patch to include new QtWebEngineProcess execution path in
    plasmashell profile (LP: #2107723):
    - d/p/u/plasmashell-QtWebEngineProcess-new-path.patch
  * Add patch to allow /cvmfs fusermounts
    (https://gitlab.com/apparmor/apparmor/-/merge_requests/1587):
    - d/p/u/fusermount3_cvmfs.patch
  * Add patch to grant OpenVPN DNS accesses (LP: #2107596, LP: #2109029)
    - d/p/u/openvpn_dnsfix.patch
  * Add patch to expand allowed fusermount3 flags for fuse_overlayfs
    (https://gitlab.com/apparmor/apparmor/-/merge_requests/1673)
    - d/p/u/fusermount3_allow_more_flags.patch
  * Add patch to fix permission denials for iotop-c (LP: #2107727):
    - d/p/u/profiles-give-iotop-c-additional-accesses.patch
  * Add patch to fix parser handling of norelatime mount flag
    (https://gitlab.com/apparmor/apparmor/-/merge_requests/1679):
    - d/p/u/parser-fix-handling-of-norelatime-mount-rule-flag.patch
  * Add patch to fix incorrect mount rule documentation in the apparmor.d
    man page (https://gitlab.com/apparmor/apparmor/-/merge_requests/1674):
    - d/p/u/fix-incorrect-mount-flag-apparmor.d-docs.patch
    - d/p/u/regression-verify-documented-mount-flag-behavior.patch
  * d/p/u/remmina_mr_1348.patch, d/p/u/remmina-dbus-describeall.patch:
    move the remmina profile to profiles/apparmor/profiles/extras to
    disable it by default (LP: #2102033)
  * debian/apparmor.install: remove the remmina profile entry
  * debian/apparmor-profiles.install: add an entry for the remmina profile
  * debian/apparmor.maintscript: remove the remmina profile upon upgrade

 -- Ryan Lee <ryan.lee@canonical.com>  Wed, 07 May 2025 11:29:02 -0700

apparmor (4.1.0~beta5-0ubuntu14) plucky; urgency=medium

  * Add patch to fix fusermount3 denials for SSSD users (LP: #2106311):
    - d/p/u/fusermount3-Include-full-nameservice-rules-for-SSSD-users.patch

 -- Alessandro Astone <alessandro.astone@canonical.com>  Thu, 10 Apr 2025 14:44:42 +0200

apparmor (4.1.0~beta5-0ubuntu13) plucky; urgency=medium

  * Rename and edit patch to fix lsblk denials on networked file systems
    (LP: #2092232):
    - d/p/u/lsblk_hyper_v_fixup.patch ->
      d/p/u/lsblk_network_disk_fixup.patch
  * Add patch to fix kernel feature search with substrings (LP: #2105986):
    - d/p/u/libapparmor-feature-match-prefixes.patch
    - d/p/u/libapparmor-bump-patch-version-for-features-prefix.patch
  * Add patch to align aa-notify userns_special_profiles default to config
    default (LP: #2106174):
    - d/p/u/utils-add-unprivileged_userns-to-aa-notify-list.patch
  * Add patches for aa-notify default config to avoid suggesting
    capabilities addition for unprivileged_userns profile (LP: #2106177):
    - d/p/u/aa-notify-dont-merge-configs-with-confdir.patch
    - d/p/u/aa-notify-userns-filtering.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Wed, 02 Apr 2025 11:01:53 -0700

apparmor (4.1.0~beta5-0ubuntu12) plucky; urgency=medium

  [ Ryan Lee ]
  * Add patch to fix lsblk denials on Hyper-V systems (LP: #2103524):
    - d/p/u/lsblk_hyper_v_fixup.patch
  * Add patch to allow fusermount3 to mount nested subdirectores of
    @{run}/user/@{uid} (LP: #2103889):
    - d/p/u/fusermount3-mount-nested-subdirs-run-user.patch
  * Add patch to fix utils hotkey conflict with ignore (LP: #2104194):
    - d/p/u/utils-fix-ignore-hotkey-conflict.patch
  * Add patch to fix aa-enforce not handling child profiles (LP: #2104193):
    - d/p/u/utils-fix-profile-header-patch-generation.patch
  [ Tim Andersson ]
  * Allow remmina to make DescribeAll calls through the DBus.
    (LP: #2102033):
    - d/p/u/remmina-dbus-describeall.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 24 Mar 2025 10:14:46 -0700

apparmor (4.1.0~beta5-0ubuntu11) plucky; urgency=medium

  * Add qt6 abstractions to fix KDE applicationis crashes.
    - d/p/ubuntu/add-qt6-abstractions.patch

 -- Scarlett Moore <sgmoore@debian.org>  Thu, 20 Mar 2025 05:48:26 -0700

apparmor (4.1.0~beta5-0ubuntu10) plucky; urgency=medium

  * Remove set -x from apparmor.postinst (LP: #2103663)

 -- Alex Murray <alex.murray@canonical.com>  Thu, 20 Mar 2025 11:58:44 +1030

apparmor (4.1.0~beta5-0ubuntu9) plucky; urgency=medium

  * Remove the patch enabling the unshare-userns-restrict profile by
    default (LP: #2102081):
    - d/p/u/Move-the-unshare-userns-restrict-profile-out-of-extras.patch
  * Add patch allowing openvpn --genkey and homedir key locations
    (LP: #2098930):
    - d/p/u/openvpn-permissive-paths.patch
  * Add patch for parser attach_disconnected.ipc mediation (LP: #2102237):
    - d/p/u/attach_disconnected_ipc.patch
  * debian/apparmor.install: remove entry for unshare-userns-restrict
  * debian/apparmor-profiles.install: add entry for
    unshare-userns-restrict
  * debian/apparmor.maintscript: remove unshare-userns-restrict profile
    if it was previously installed
  * Add a patch to support "yes"/"no" literal values for the
    unconfined_restrictions/userns sysctl (LP: #2102680):
    - d/p/u/userns-runtime-disable-fix-for-6_14.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 13 Mar 2025 09:49:44 -0700

apparmor (4.1.0~beta5-0ubuntu8) plucky; urgency=medium

  * Add a patch to allow OpenVPN access to the systemd notify socket
    (LP: #2101796):
    - d/p/u/openvpn-systemd-notify.patch
  * Add a patch to allow OpenVPN to read NetworkManager imported certs
    (LP: #2101909):
    - d/p/u/openvpn-networkmanager-imports.patch
  * Add a patch to allow utils to parse the fusermount profile
    (LP: #2101869):
    - d/p/u/utils-fix-mount-handling-hyphens.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 10 Mar 2025 09:43:48 -0700

apparmor (4.1.0~beta5-0ubuntu7) plucky; urgency=medium

  * Add patch to add os-prober and linux-boot-prober profiles
    (LP: #2099811):
    - d/p/u/os_prober_mr_1569.patch
  * debian/apparmor.install: add entries for the os-prober and
    linux-boot-prober profiles

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 06 Mar 2025 10:44:41 -0800

apparmor (4.1.0~beta5-0ubuntu6) plucky; urgency=medium

  * Add patch for lsusb profile to access non-PCI USB info (LP: #2099990):
    - d/p/u/lsusb_profile_fixup.patch
  * Add patches to enable Python utils to skip profiles they can't parse
    (LP: #2100744):
    - d/p/u/0001-utils-read_profiles-robust-against-unparseable.patch
    - d/p/u/0002-utils-test-minitools-resiliency-against-unparsed.patch
    - d/p/u/0003-utils-remove-the-skip_-_profiles-testing-bypass.patch
  * Add patch to fix fusermount3 profile breaking flatpaks (LP: #2100295)
    - d/p/u/fusermount3-flatpak-fixup.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 27 Feb 2025 14:45:18 -0800

apparmor (4.1.0~beta5-0ubuntu5) plucky; urgency=medium

  * Add patch to fix fusermount3 profile breaking AppImages (LP: #2098993)
    - d/p/u/fusermount3_profile_fixup.patch
  * debian/apparmor.maintscript: remove tar and wpa_supplicant profiles
    if they were previously installed via an upgrade

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 20 Feb 2025 09:18:01 -0800

apparmor (4.1.0~beta5-0ubuntu4) plucky; urgency=medium

  * Add patch to fix sbuild unshare breakage caused by the new
    unshare-userns-restrict profile (LP: #2098906)
    - d/p/u/sbuild_mr_1555.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Wed, 19 Feb 2025 16:24:56 -0800

apparmor (4.1.0~beta5-0ubuntu3) plucky; urgency=medium

  * Add patch to address AppArmor denial logs reported in LP: #2098838:
    - d/p/u/wpa_supplicant_profile_fixup.patch
  * debian/apparmor.install: remove wpa_supplicant profile from default
    install
  * debian/apparmor-profiles.install: place wpa_supplicant profile in
    extra-profiles

 -- Ryan Lee <ryan.lee@canonical.com>  Wed, 19 Feb 2025 13:56:15 -0800

apparmor (4.1.0~beta5-0ubuntu2) plucky; urgency=medium

  * Add patch to add capability fowner permission to the tar profile to
    fix tar and snapd autopkgtest failures
    - d/p/u/tar_cap_fowner_fix_mr_1553.patch
  * debian/apparmor.install: remove tar profile from default install
  * debian/apparmor-profiles.install: place tar profile in extra-profiles

 -- Alex Murray <alex.murray@canonical.com>  Wed, 19 Feb 2025 12:08:03 +1030

apparmor (4.1.0~beta5-0ubuntu1) plucky; urgency=medium

  * New upstream release.
  * Dropped patches that were applied upstream:
    - d/p/u/profiles-fix-non-user-namespace-bypass-in-unshare.patch
    - d/p/u/libapparmor-swig-various-fixes-for-32bit-and-older.patch
    - d/p/u/aa-notify-ttkthemes-fallback-mr1324-partial.patch
    - d/p/u/aa-notify-fix-packaging-polkit.patch
    - d/p/u/utils-allow-install-locations-to-be-overridden-in-Make.patch
  * Add patch to fix Perl SWIG typemaps to complement upstream SWIG updates:
    - d/p/u/libapparmor-swig-perl-typemaps.patch
  * debian/apparmor.install: add entry for new upstream tunables/system
    tunable
  * debian/apparmor-notify.install: update location of polkit policy
    file to match the new upstream location

 -- Ryan Lee <ryan.lee@canonical.com>  Tue, 18 Feb 2025 09:17:44 -0800

apparmor (4.1.0~beta4-0ubuntu3) plucky; urgency=medium

  * Add patch to fix build path leaking into generated polkit file:
    - d/p/u/aa-notify-fix-packaging-polkit.patch
  * Add patch to enable environment variable overrides in utils Makefile:
    - d/p/u/utils-allow-install-locations-to-be-overridden-in-Make.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 13 Feb 2025 14:30:46 -0800

apparmor (4.1.0~beta4-0ubuntu2) plucky; urgency=medium

  * Add patch to fix libapparmor SWIG build on 32-bit systems:
    - d/p/u/libapparmor-swig-various-fixes-for-32-bit-and-older.patch
  * Add patch for aa-notify GUI fallback when python3-ttkthemes is
    unavailable:
    - d/p/u/aa-notify-ttkthemes-fallback-mr1324-partial.patch
  * Add patch with another new AppArmor profile for testing:
    - d/p/u/mosquitto_mr_1506.patch
  * debian/apparmor.install: add entry for the mosquitto profile
  * debian/control: remove python3-ttkthemes from Build-Depends to fix
    i386 build now that fallback is available

 -- Ryan Lee <ryan.lee@canonical.com>  Wed, 12 Feb 2025 15:30:49 -0800

apparmor (4.1.0~beta4-0ubuntu1) plucky; urgency=medium

  * New upstream release.
  * Auto-refreshed patches via quilt refresh:
    - d/p/u/profiles-grant-access-to-systemd-resolved.patch
    - d/p/u/samba-systemd-interaction.patch
    - d/p/u/parser-fix-pam_apparmor-regression-test-failures.patch
  * Drop patches that were applied upstream:
    - d/p/u/utils-change-os.mkdir-to-self.mkpath-to-create-inter.patch
    - d/p/u/parser-fix-rule-priority-destroying-rule-permissions.patch
    - d/p/u/libapparmor-make-af_protos.h-consistent-in-different.patch
    - d/p/u/fix-abi-break-record-for-aa-log-record.patch
    - d/p/u/handle-missing-cgitb.patch
  * Drop patches that were superseded upstream:
    - d/p/u/parser-fix-integer-overflow-bug-in-rule-priority-com.patch
    - d/p/u/parser-revert-removal-of-second-minimization-pass.patch
    - d/p/u/parser-update-tsts-for-explicit-deny-and-filtering-c.patch
  * Add patches containing new AppArmor profiles for more testing:
    - d/p/u/znc_mr_1376.patch
    - d/p/u/tfntp_mr_1363.patch
    - d/p/u/socat_mr_1319.patch
    - d/p/u/rygel_mr_1311.patch
    - d/p/u/remmina_mr_1348.patch
    - d/p/u/lsusb_mr_1433.patch
    - d/p/u/lsblk_mr_1437.patch
    - d/p/u/mbsync_mr_1372.patch
    - d/p/u/openvpn_mr_1263.patch
    - d/p/u/tshark_mr_1384.patch
    - d/p/u/wireguard_mr_1323.patch
    - d/p/u/irssi_mr_1332.patch
    - d/p/u/netcat-openbsd_mr_1327.patch
    - d/p/u/tar_mr_1453.patch
    - d/p/u/alsamixer_mr_1517.patch
    - d/p/u/tinyproxy_mr_1477.patch
    - d/p/u/frr_mr_1380.patch
    - d/p/u/iotop_c_mr_1520.patch
    - d/p/u/wpa_supplicant_mr_1385.patch
    - d/p/u/fusermount3_mr_1514.patch
    - d/p/u/dnstracer_mr_1366.patch
  * Add a patch to enable the *-userns-restrict profiles by default:
    - d/p/u/Move-the-bwrap-userns-restrict-profile-out-of-extras.patch
    - d/p/u/Move-the-unshare-userns-restrict-profile-out-of-extras.patch
  * Add a patch that deletes the busybox and nautilus profiles:
    - d/p/u/delete-the-busybox-and-nautilus-profiles.patch
  * debian/apparmor.dirs: remove /lib/apparmor as it would already be
    created by the file installation process
  * debian/apparmor.install:
    - Install some files into /usr directory instead of under root
      directory (as per the /usr merge):
      - lib/apparmor/profile-load
      - sbin/apparmor_parser
      - parser/apparmor.systemd
      - lib/apparmor/rc.apparmor/functions
    - Install newly added profiles from profile patches above, with
      the exception of the socat profile (d/p/u/socat_mr_1319.patch)
    - Add installation of the *-userns-restrict profiles to install
      them to /etc/apparmor.d/
    - Remove entries for the busybox and nautilus profiles
  * debian/apparmor.manpages: add upstream aa-load.8 man page
  * debian/apparmor-profiles.install:
    - Add entry for new upstream postfix-tlsproxy profile
    - Add entry for the socat profile (d/p/u/socat_mr_1319.patch)
    - Remove entries for *-userns-restrict profiles (moved to debian/
      apparmor.install)
  * debian/control:
    - Add utils Build-Depends under a !nocheck condition for tests:
      - flake8
      - python3-gi
      - python3-notify2
      - python3-psutil
      - python3-tk
      - python3-ttkthemes
  * debian/rules:
    - override_dh_auto_build
      - No longer create libraries/libapparmor/testsuite/test_multi/
        testcase_mqueue_0[1-8].err empty files, as the patch they were
        supposed to accompany was applied upstream
    - override_dh_auto_test
      - Test libapparmor in override_dh-auto-test before the parser and
        binutils
      - Add step that runs tests for utils
    - override_dh_install-arch
      - Fixup chmod call for lib/apparmor/apparmor.systemd for /usr
        install location
  * debian/libpam-apparmor.install:
    - Install lib/security/pam_apparmor.so into /usr directory (as per
      the /usr merge)
  * debian/usr/lib/sysctl.d/10-apparmor.conf: Set sysctl
    kernel.apparmor_restrict_unprivileged_unconfined=1

 -- Ryan Lee <ryan.lee@canonical.com>  Tue, 11 Feb 2025 17:12:16 -0800

apparmor (4.1.0~beta1-0ubuntu5) plucky; urgency=medium

  * d/p/u/handle-missing-cgitb.patch: handle the missing cgitb module, no
    longer shipped with python 3.13 (LP: #2095597)

 -- Andreas Hasenack <andreas@canonical.com>  Tue, 28 Jan 2025 14:21:29 -0300

apparmor (4.1.0~beta1-0ubuntu4) plucky; urgency=medium

  * SRU: #2083480: No-change rebuild to add support for Python 3.13.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 13 Nov 2024 09:56:58 +0100

apparmor (4.1.0~beta1-0ubuntu3) oracular; urgency=medium

  * Add patch from upstream to fix unintentional ABI break (LP :#2083435)
  - d/p/u/fix-abi-break-record-for-aa-log-record.patch

 -- Alex Murray <alex.murray@canonical.com>  Wed, 02 Oct 2024 08:54:43 +0930

apparmor (4.1.0~beta1-0ubuntu2) oracular; urgency=medium

  [Georgia Garcia]
  * Add patch to fix FTBFS on armhf
    - d/p/u/libapparmor-make-af_protos.h-consistent-in-different.patch

 -- Alex Murray <alex.murray@canonical.com>  Tue, 20 Aug 2024 08:54:20 +0930

apparmor (4.1.0~beta1-0ubuntu1) oracular; urgency=medium

  [John Johansen]
  * New upstream release.
  * Refresh
    - d/p/d/libapparmor-layout-deb.patch
    - d/p/d/etc-writable.patch
  * Drop patches which have now been applied upstream
    - d/p/u/parser-add-support-for-prompting.patch
    - d/p/u/profiles-add-unconfined-balena-etcher-profile.patch
    - d/p/u/mountrule-relaxing-constraints-on-fstype.patch
    - d/p/u/tests-refactor-logic-that-makes-mntpoint-private-for.patch
    - d/p/u/tests-remount-tmpdir-as-private-instead-of.patch
    - d/p/u/tests-enable-swap-test-when-tmp-is-tmpfs.patch
    - d/p/u/test-detect-if-setuid-environ-test-in-running-under-.patch
  * Add patch to fix installation of com.ubuntu.pkexec.aa-notify.policy
    - d/p/u/parser-fix-rule-priority-destroying-rule-permissions.patch
    - d/p/u/parser-fix-integer-overflow-bug-in-rule-priority-com.patch
    - d/p/u/parser-revert-removal-of-second-minimization-pass.patch
    - d/p/u/parser-update-tsts-for-explicit-deny-and-filtering-c.patch
  [Georgia Garcia]
  * Add patch to fix installation of com.ubuntu.pkexec.aa-notify.policy
    - d/p/u/utils-change-os.mkdir-to-self.mkpath-to-create-inter.patch
    - d/p/u/ubuntu/parser-fix-pam_apparmor-regression-test-failures.patch
  * d/apparmor.install
    - fix wike installation path
    - install new profile
      - Xorg
      - chromium
  * d/control:
    - add depends to apparmor-notify:
      - python3-tk
      - python3-ttkthemes
      - python3-gi
  * d/apparmor-notify.install
    - etc/apparmor/default_unconfined.template
    - usr/share/polkit-1/actions/com.ubuntu.pkexec.aa-notify.policy
  * d/libapparmor1.symbols
    - add aa_split_overlay_str

 -- John Johansen <john.johansen@canonical.com>  Thu, 15 Aug 2024 06:41:27 -0700

apparmor (4.0.1really4.0.1-0ubuntu2) oracular; urgency=medium

  * Drop patch that enables bwrap profile
  - d/p/u/enable-bwrap-profile.patch (LP: #2072811)
  * d/apparmor.install
    - remove bwrap-userns-restrict
  * d/apparmor.maintscript: rm_conffile of bwrap-userns-restrict in
    /etc/apparmor.d/ to properly revert conffiles introduced in
    4.0.1-0ubuntu1
  * d/apparmor-profiles.install
    - install new profile
      - bwrap-userns-restrict
  * Drop patch that moves wike profile from apparmor to apparmor.d so it's
  done by d/apparmor.install. The patch caused a warning from dpkg-source
  because it didn't contain a diff
  * d/apparmor.install
    - install new profile
      - wike - changed installation from apparmor to apparmor.d
  * Add patches that fix regression tests when they run on a mounted /tmp
    in tmpfs
    - d/p/u/tests-refactor-logic-that-makes-mntpoint-private-for.patch
    - d/p/u/tests-remount-tmpdir-as-private-instead-of.patch
    - d/p/u/tests-enable-swap-test-when-tmp-is-tmpfs.patch
    - d/p/u/test-detect-if-setuid-environ-test-in-running-under-.patch

 -- Georgia Garcia <georgia.garcia@canonical.com>  Tue, 16 Jul 2024 14:33:39 -0300

apparmor (4.0.1-0ubuntu1) oracular; urgency=medium

  [Georgia Garcia]
  * New upstream release.
  * Refresh
    - d/p/u/parser-add-support-for-prompting.patch
      - Add condition in policydb serialization to only encode xtable if
      kernel_supports_permstable32
  * Add patch to fix wike profile location (LP: #2046844)
    - d/p/u/profiles-fix-wike-profile-location-to-apparmor.d.patch
  * Add patch to add balena-etcher profile (LP: #2046844)
    - d/p/u/profiles-add-unconfined-balena-etcher-profile.patch
  * Fix d/p/u/userns-runtime-disable.patch to work when
    kernel.apparmor_restrict_unprivileged_userns does not exist by adding
    -e to sysctl.
  * d/apparmor.install
    - install new profiles
      - wike
      - foliate
      - balena-etcher
      - transmission

  [John Johansen]
  * Refresh
    - d/p/u/samba-systemd-interaction.patch
  * Drop patches which have now been applied updatea
    - d/p/u/parser-fix-issues-appointed-by-coverity.patch
    - d/p/u/profiles-add-unconfined-profile-for-tuxedo-control-c.patch
  * Add patch to enable bwrap profile
    - d/p/u/enable-bwrap-profile.patch
      (LP: #2046844)
  * d/apparmor.install
    - install new profile
      - bwrap-userns-restrict
  * d/apparmor-profiles.install
    - install new profile
      - unshare-userns-restrict

  [ Alex Murray ]
  * Add upstream patch to relax mount rules to fix use of virtiofs and
    other file-system types
    - d/p/u/mountrule-relaxing-constraints-on-fstype.patch
  * Remove patches which got dropped from quilt series earlier
    - d/p/u/parser-support-uin128_t-key-as-a-pair-of-uint64_t-nu.patch
    - d/p/u/Minor-improvements-for-MountRule.patch
  * d/control: Remove obsolete lsb-base Depends and swap pkg-config to
    pkgconf for Build-Depends

 -- Alex Murray <alex.murray@canonical.com>  Wed, 08 May 2024 11:37:47 +0200

apparmor (4.0.0-beta3-0ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 07:27:03 +0000

apparmor (4.0.0-beta3-0ubuntu2) noble; urgency=medium

  * d/apparmor.install
    - install new profiles
      - geary
      - goldendict
      - kchmviewer
      - loupe
      - notepadqq
      - pageedit
      - privacybrowser
      - qmapshack
      - qutebrowser
      - rssguard
      - scide
      - tuxedo-control-center
      - unix-chkpwd

 -- John Johansen <johnjohansen@canonical.com>  Mon, 18 Mar 2024 18:34:14 -0700

apparmor (4.0.0-beta3-0ubuntu1) noble; urgency=medium

  * New upstream release.
    (LP: #2058329, LP: #2056747, LP: #2056739, LP: #2046844)
  * Refresh patches
    - d/p/u/samba-systemd-interaction.patch
    - d/p/u/parser-add-support-for-prompting.patch
  * Drop patches which have now been applied upstream
    - ubuntu/parser-support-uin128_t-key-as-a-pair-of-uint64_t-nu.patch
    - ubuntu/Minor-improvements-for-MountRule.patch
  * Add patches from upstream that are post Beta3 and will be in Beta4
    - d/p/u/parser-fix-issues-appointed-by-coverity.patch
    - d/p/u/profiles-add-unconfined-profile-for-tuxedo-control-c.patch
      (LP: #2046844)
 -- John Johansen <johnjohansen@canonical.com>  Mon, 18 Mar 2024 16:48:32 -0700

apparmor (4.0.0~beta2-0ubuntu3) noble; urgency=medium

  * Add fix for failing mount rule tests
    - d/p/u/Minor-improvements-for-MountRule.patch

 -- John Johansen <johnjohansen@canonical.com>  Thu, 07 Mar 2024 11:32:22 -0800

apparmor (4.0.0~beta2-0ubuntu2) noble; urgency=medium

  * No-change update .changes file to include everything from 4.0.0~alpha4-0ubuntu1

 -- John Johansen <johnjohansen@canonical.com>  Wed, 06 Mar 2024 22:08:28 -0800

apparmor (4.0.0~beta2-0ubuntu1) noble; urgency=medium

  * New upstream release.
  * Refresh patches
    - d/p/u/parser-add-support-for-prompting.patch
 -- John Johansen <johnjohansen@canonical.com>  Wed, 06 Mar 2024 18:29:50 -0800

apparmor (4.0.0~beta1-0ubuntu4) noble; urgency=medium

  * Add fix for 32 bit architectures
    - d/p/u/parser-support-uin128_t-key-as-a-pair-of-uint64_t-nu.patch
 -- John Johansen <johnjohansen@canonical.com>  Thu, 29 Feb 2024 17:32:43 -0800

apparmor (4.0.0~beta1-0ubuntu3) noble; urgency=medium

  * Update uint128_t define
    - d/p/u/parser-add-support-for-prompting.patch
 -- John Johansen <johnjohansen@canonical.com>  Thu, 29 Feb 2024 16:42:15 -0800

apparmor (4.0.0~beta1-0ubuntu2) noble; urgency=medium

  * Add feature support patches for prompt
    - d/p/u/parser-add-support-for-prompting.patch
 -- John Johansen <johnjohansen@canonical.com>  Thu, 29 Feb 2024 16:12:32 -0800

apparmor (4.0.0~beta1-0ubuntu1) noble; urgency=medium

  * New upstream release.
  * Drop patches which have now been applied upstream
    - d/p/u/add-keybase-unconfined-profile.patch
    - d/p/u/add-more-unconfined-profiles.patch
    - d/p/u/tests-fix-usr-merge-failures-on-exec-and-regex-tests.patch
    - d/p/u/tests-handle-unprivileged_userns-transition-in-usern.patch
  * Refresh patches
    - d/p/u/samba-systemd-interaction.patch
  * d/apparmor.install
    - install new profiles
      - nautilus
      - element-desktop
  * d/control: add build-dependency on autoconf-archive

 -- Georgia Garcia <georgia.garcia@canonical.com>  Thu, 29 Feb 2024 19:33:32 -0300

apparmor (4.0.0~alpha4-0ubuntu1) noble; urgency=medium

  [Georgia Garcia]
  * New upstream release.
  * Add unconfined profiles to support the use unprivileged user namespace
    (LP: #2052297, LP: #2046844)
    - d/p/u/add-keybase-unconfined-profile.patch
    - d/p/u/add-more-unconfined-profiles.patch
  * Fix regression tests failures on regex.sh, exec.sh and userns.sh
    - d/p/u/tests-fix-usr-merge-failures-on-exec-and-regex-tests.patch
    - d/p/u/tests-handle-unprivileged_userns-transition-in-usern.patch
  * Drop patches which have now been applied upstream
    - d/p/u/userns-unconfined-profiles.patch
    - d/p/u/tests-fix-userns-setns-opening-pipe-order.patch
    - d/p/u/tests-replace-individual-socket-permissions.patch
    - d/p/u/tests-fix-test-specifying-path-on-attach-disconnected.patch
    - d/p/u/binutils-aa_status.c-quiet-verbose-outputs-when-json.patch
    - d/p/u/oot-unconfined-profiles.patch
  * Refresh patches
    - d/p/d/etc-writable.patch
    - d/p/u/profiles-grant-access-to-systemd-resolved.patch
    - d/p/u/userns-runtime-disable.patch
  * d/apparmor.install
    - install new profiles
      - plasmashell
      - surfshark
      - unprivileged_userns
      - keybase
      - devhelp
      - epiphany
      - evolution
      - opam
    - renamed profiles
      - ch-checkns
      - ch-run
      - crun
      - flatpak
      - linux-sandbox
      - busybox
      - buildah
      - cam
      - ipa_verify
      - lc-compliance
      - libcamerify
      - qcam
      - podman
      - lxc-attach
      - lxc-create
      - lxc-destroy
      - lxc-execute
      - lxc-stop
      - lxc-unshare
      - lxc-usernsexec
      - mmdebstrap
      - vpnns
      - QtWebEngineProcess
      - systemd-coredump
      - rootlesskit
      - rpm
      - runc
      - virtiofsd
      - sbuild
      - sbuild-abort
      - sbuild-adduser
      - sbuild-apt
      - sbuild-checkpackages
      - sbuild-clean
      - sbuild-createchroot
      - sbuild-destroychroot
      - sbuild-distupgrade
      - sbuild-hold
      - sbuild-shell
      - sbuild-unhold
      - sbuild-update
      - sbuild-upgrade
      - slirp4netns
      - stress-ng
      - thunderbird
      - toybox
      - trinity
      - tup
      - userbindmount
      - uwsgi-core
      - vdens
      - chrome
      - msedge
      - brave
      - vivaldi-bin
  * d/apparmor.maintscript
    - add renamed profiles so they are removed on upgrade
  * d/libapache2-mod-apparmor.install
    - remove etc/apparmor.d/local/usr.sbin.apache2, no longer needed

  [John Johansen]
  * debian/rules:
    - don't run debian/put-all-profiles-in-complain-mode.sh on install

  [Alex Murray]
  * debian/apparmor.lintian-overrides:
    - suppress false-positive warning about needing a Depends: on adduser
      for the apparmor binary package

 -- Georgia Garcia <georgia.garcia@canonical.com>  Fri, 02 Feb 2024 16:12:21 -0300

apparmor (4.0.0~alpha2-0ubuntu8) noble; urgency=medium

  * Add unconfined userns profile for systemd-coredump

 -- Nick Rosbrook <enr0n@ubuntu.com>  Wed, 10 Jan 2024 09:55:51 -0500

apparmor (4.0.0~alpha2-0ubuntu7) noble; urgency=medium

  [Alex Murray]
  * Enable user namespace restrictions by default (LP: #2046477)
    - d/p/u/userns-runtime-disable.patch: add logic to disable user
      namespace restrictions if kernel lacks support
    - debian/usr/lib/sysctl.d/10-apparmor.conf: set sysctl value to 1 and
      update comment to match
    - debian/apparmor.service: run After systemd-sysctl.service

  [John Johansen]
  * Add additional AppArmor profiles to support third-party applications
    that use unprivileged user namespace
    - add d/p/u/oot-unconfined-profiles.patch
    - add profiles to debian/apparmor.install
       - /etc/apparmor.d/1password
       - /etc/apparmor.d/Discord
       - /etc/apparmor.d/MongoDB_Compass
       - /etc/apparmor.d/code
       - /etc/apparmor.d/firefox
       - /etc/apparmor.d/github-desktop
       - /etc/apparmor.d/obsidian
       - /etc/apparmor.d/opera
       - /etc/apparmor.d/polypane
       - /etc/apparmor.d/signal-desktop
       - /etc/apparmor.d/slack
       - /etc/apparmor.d/steam

  [Alex Murray]
  * Drop duplicate profiles for usr.share.code.bin.code and
  * usr.lib.multiarch.opera.opera since they are now also in
    d/p/u/oot-unconfined-profiles.patch
    - modified d/p/u/userns-unconfined-profiles.patch to remove them
    - removed from debian/apparmor.install
    - added to debian/apparmor.maintscript to ensure they are removed on
      upgrade

 -- John Johansen <john.johansen@canonical.com>  Wed, 13 Dec 2023 20:38:45 -0800

apparmor (4.0.0~alpha2-0ubuntu6) noble; urgency=medium

  * No-change rebuild with Python 3.12 as supported version

 -- Graham Inggs <ginggs@ubuntu.com>  Tue, 31 Oct 2023 16:45:44 +0000

apparmor (4.0.0~alpha2-0ubuntu5) mantic; urgency=medium

  * Add additional AppArmor profiles to support third-party applications
    that use unprivileged user namespace restrictions (LP: #2036698)
    - Refreshed d/p/u/userns-unconfined-profiles.patch to add additional
      profiles and added to debian/apparmor.install
       - usr.share.code.bin.code
       - opt.microsoft.msedge.msedge
       - usr.lib.multiarch.opera.opera
       - opt.brave.com.brave.brave
       - opt.vivaldi.vivaldi-bin
  * Clarify comment in sysctl.d conf file that this feature is not
    enabled by default but can be overridden by the user if desired.

 -- Alex Murray <alex.murray@canonical.com>  Fri, 22 Sep 2023 16:50:22 +0930

apparmor (4.0.0~alpha2-0ubuntu4) mantic; urgency=medium

  * Remove conflicting profile for usr.bin.lxc-start (LP: #2036302)
    - d/p/u/userns-unconfined-profiles.patch: Don't ship a profile for
      usr.bin.lxc-start as this is already shipped in liblxc-common
    - debian/apparmor.install: Remove usr.bin.lxc-start profile

 -- Alex Murray <alex.murray@canonical.com>  Mon, 18 Sep 2023 10:59:37 +0930

apparmor (4.0.0~alpha2-0ubuntu3) mantic; urgency=medium

  * Add remaining AppArmor profiles to support unprivileged user
    namespace restrictions (LP: #2035315)
    - Refreshed d/p/u/userns-unconfined-profiles.patch to add remaining
      profiles and added to debian/apparmor.install
       - usr.libexec.multiarch.bazel.linux-sandbox
       - usr.bin.busybox
       - usr.bin.buildah
       - usr.bin.cam
       - usr.bin.ipa_verify
       - usr.bin.lc-compliance
       - usr.bin.libcamerify
       - usr.bin.qcam
       - usr.bin.podman
       - usr.bin.lxc-attach
       - usr.bin.lxc-create
       - usr.bin.lxc-destroy
       - usr.bin.lxc-execute
       - usr.bin.lxc-start
       - usr.bin.lxc-stop
       - usr.bin.lxc-unshare
       - usr.bin.lxc-usernsexec
       - usr.bin.mmdebstrap
       - usr.bin.vpnns
       - usr.lib.qt6.libexec.QtWebEngineProcess
       - usr.lib.multiarch.qt5.libexec.QtWebEngineProcess
       - usr.bin.rootlesskit
       - usr.bin.rpm
       - usr.sbin.runc
       - usr.libexec.virtiofsd
       - usr.bin.sbuild
       - usr.bin.sbuild-abort
       - usr.bin.sbuild-apt
       - usr.bin.sbuild-checkpackages
       - usr.bin.sbuild-clean
       - usr.bin.sbuild-createchroot
       - usr.bin.sbuild-distupgrade
       - usr.bin.sbuild-hold
       - usr.bin.sbuild-shell
       - usr.bin.sbuild-unhold
       - usr.bin.sbuild-update
       - usr.bin.sbuild-upgrade
       - usr.sbin.sbuild-adduser
       - usr.sbin.sbuild-destroychroot
       - usr.bin.slirp4netns
       - usr.bin.stress-ng
       - usr.bin.thunderbird
       - bin.toybox
       - usr.bin.trinity
       - usr.bin.tup
       - usr.bin.userbindmount
       - usr.bin.uwsgi-core
       - usr.bin.vdens
       - opt.google.chrome.chrome

 -- Alex Murray <alex.murray@canonical.com>  Thu, 14 Sep 2023 15:58:40 +0930

apparmor (4.0.0~alpha2-0ubuntu2) mantic; urgency=medium

  * Fix invalid JSON output from aa-status --json via upstream patch
    (LP: #2032994)
    - d/p/u/binutils-aa_status.c-quiet-verbose-outputs-when-json.patch

 -- Alex Murray <alex.murray@canonical.com>  Fri, 25 Aug 2023 09:48:24 +0930

apparmor (4.0.0~alpha2-0ubuntu1) mantic; urgency=medium

  [ John Johansen ]
  * New upstream release 4.0-alpha2

  [ Alex Murray ]
  * Infrastructure to enable AppArmor userns restrictions
    (LP: #2030353, LP: #2032602)
    - debian/usr/lib/sysctl.d/10-apparmor.conf: disable userns restrictions
      for now until we have a complete set of profiles for the whole
      Ubuntu archive
    - debian/apparmor.install: ship sysctl.d file in the apparmor binary
      package
    - d/p/u/userns-unconfined.patch: add some additional profiles that
      specify the userns permission with the unconfined flag for a currently
      incomplete list of applications within the Ubuntu archive that use
      unprivileged user namespaces
      - usr.bin.ch-checkns
      - usr.bin.ch-run
      - usr.bin.crun
      - usr.bin.flatpak
    - debian/put-all-profiles-in-complain-mode.sh: don't put unconfined
      profiles in complain mode
  * Add patches from upstream to fix test failures
    - d/p/u/tests-fix-userns-setns-opening-pipe-order.patch
    - d/p/u/tests-replace-individual-socket-permissions.patch
    - d/p/u/tests-fix-test-specifying-path-on-attach-disconnected.patch
  * Add new symbols

 -- Alex Murray <alex.murray@canonical.com>  Tue, 22 Aug 2023 12:30:32 +0930

apparmor (4.0.0~alpha1-0ubuntu1) mantic; urgency=medium

  * New upstream release.
  * Drop patches which have now been applied upstream
    - d/p/fix-expected-library-version.patch
    - d/p/u/enable-pinning-of-pre-AppArmor-3.x-poli.patch
    - d/p/u/regression-tests-fix-aa_policy_cache-when-using-syst.patch
    - d/p/u/add-mqueue-support.patch
    - d/p/u/add-userns-support.patch
    - d/p/u/update-snap-browsers-permissions-lp1794064.patch
    - d/p/u/add-4.0-abi.patch
  * Refresh patches
    - d/p/d/etc-writable.patch
    - d/p/u/samba-systemd-interaction.patch
  * d/apparmor.install: install aa-load
  * d/apparmor-profiles.install:
    - install new profiles
      - usr.lib.dovecot.director
      - usr.lib.dovecot.doveadm-server
      - usr.lib.dovecot.replicator
      - zgrep
      - rpcbind
      - chromium_browser
      - usr.bin.pyzorsocket
      - usr.bin.razorsocket
      - usr.sbin.clamd
      - usr.sbin.haproxy
    - rename profiles
      - firefox
      - firefox.sh

 -- Georgia Garcia <georgia.garcia@canonical.com>  Tue, 11 Jul 2023 17:20:09 -0300

apparmor (3.0.8-1ubuntu4) mantic; urgency=medium

  * Backport 4.0 ABI from upstream (LP: #2026227)
    - d/p/u/add-4.0-abi.patch

 -- Alex Murray <alex.murray@canonical.com>  Thu, 06 Jul 2023 12:14:15 +0930

apparmor (3.0.8-1ubuntu3) mantic; urgency=medium

  * Update abstractions/snap-browsers to include lock permissions
    (LP: #1794064)
    - d/p/u/update-snap-browsers-permissions-lp1794064.patch

 -- Georgia Garcia <georgia.garcia@canonical.com>  Tue, 06 Jun 2023 08:52:13 -0300

apparmor (3.0.8-1ubuntu2) lunar; urgency=medium

  * Rebuild to drop Python 3.10 extension

 -- Jeremy Bicha <jbicha@ubuntu.com>  Tue, 28 Feb 2023 17:18:12 -0500

apparmor (3.0.8-1ubuntu1) lunar; urgency=medium

  * Merge from Debian unstable; remaining changes:
    - Enable Ubuntu specific patches:
      - d/p/u/communitheme-snap-support.patch
      - d/p/u/mimeinfo-snap-support.patch
      - d/p/u/profiles-grant-access-to-systemd-resolved.patch
      - d/p/u/enable-pinning-of-pre-AppArmor-3.x-poli.patch
      - d/p/u/regression-tests-fix-aa_policy_cache-when-using-syst.patch
      - d/p/u/samba-systemd-interaction.patch
      - d/p/u/add-mqueue-support.patch
      - d/p/u/add-userns-support.patch
    - Disable Debian specific patches:
      - d/p/d-o/pin-feature-set.patch
      - d/p/d-o/aa-notify-point-to-Debian-documentation.patch
      - d/p/d-o/Document-which-AppArmor-features-are-not-supported-on-Deb.patch
    - d/{control,gbp.conf}:
      - Update Vcs / git branch for ubuntu
    - d/apparmor.install:
      - Disable debian feature pinning
    - d/rules:
      - Create empty files of expected mqueue testcase err output added in
        d/p/u/add-mqueue-support.patch since quilt does not support creating
        new empty files
  * Dropped Ubuntu specific changes which have now been applied upstream
    - d/p/u/lp1990692-update-samba-profile.patch
    - d/p/u/samba-rpcd-spoolss.patch

 -- Alex Murray <alex.murray@canonical.com>  Mon, 12 Dec 2022 15:48:20 +1030

apparmor (3.0.8-1) unstable; urgency=medium

  * New upstream release
  * debian/watch: only track the 3.0 series for now
  * Add upstream patch to fix test suite

 -- intrigeri <intrigeri@debian.org>  Sat, 10 Dec 2022 17:54:51 +0000

apparmor (3.0.7-1ubuntu4) lunar; urgency=medium

  * d/p/u/samba-rpcd-spoolss.patch: fix samba-rpcd-spoolss apparmor
    profile (LP: #1993572)

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 23 Nov 2022 14:47:14 -0300

apparmor (3.0.7-1ubuntu3) lunar; urgency=medium

  * No-change rebuild with Python 3.11 as supported

 -- Graham Inggs <ginggs@ubuntu.com>  Wed, 02 Nov 2022 10:11:19 +0000

apparmor (3.0.7-1ubuntu2) kinetic; urgency=medium

  * ubuntu/add-mqueue-support.patch: add message queue IPC support to
    parser, python tools, and regression tests.
  * ubuntu/add-userns-support.patch: add user namespace support to
    parser.
  * ubuntu/lp1990692-update-samba-profile.patch: update samba policy to
    enable the printing subsystem to work (LP: #1990692)

 -- Georgia Garcia <georgia.garcia@canonical.com>  Fri, 23 Sep 2022 18:21:44 -0300

apparmor (3.0.7-1ubuntu1) kinetic; urgency=medium

  * Merge from Debian unstable; remaining changes:
    - Enable Ubuntu specific patches:
      - d/p/u/communitheme-snap-support.patch
      - d/p/u/mimeinfo-snap-support.patch
      - d/p/u/profiles-grant-access-to-systemd-resolved.patch
      - d/p/u/enable-pinning-of-pre-AppArmor-3.x-poli.patch
    - Add additional Ubuntu specific patches:
      - d/p/u/regression-tests-fix-aa_policy_cache-when-using-syst.patch
      - d/p/u/samba-systemd-interaction.patch
    - Disable Debian specific patches:
      - d/p/d-o/pin-feature-set.patch
      - d/p/d-o/aa-notify-point-to-Debian-documentation.patch
      - d/p/d-o/Document-which-AppArmor-features-are-not-supported-on-Deb.patch
    - d/{control,gbp.conf}:
      - Update Vcs / git branch for ubuntu
    - d/apparmor.install:
      - Disable debian feature pinning
  * Dropped Ubuntu specific changes which have now been applied upstream
    - d/p/u/abstraction-exo-open-Remove-dbus-deny-rule.patch

 -- Alex Murray <alex.murray@canonical.com>  Thu, 18 Aug 2022 16:02:52 +0930

apparmor (3.0.7-1) unstable; urgency=medium

  * New upstream release

 -- intrigeri <intrigeri@debian.org>  Tue, 16 Aug 2022 14:09:22 +0000

apparmor (3.0.6-1) unstable; urgency=medium

  * New upstream release (Closes: #1015354)
  * Drop patch that was applied upstream
  * Enable LTO
  * Declare compliance with Policy 4.6.1

 -- intrigeri <intrigeri@debian.org>  Tue, 02 Aug 2022 09:15:54 +0000

apparmor (3.0.5-1) unstable; urgency=medium

  * New upstream release
  * Drop patches that were applied upstream
  * Drop profile-load script: part of upstream 3.0.5
  * Install newly upstreamed aa-notify.desktop instead of the custom Debian one
  * Rename debian/master branch to debian/unstable
  * New patch, to fix new upstream "dirtest" test
  * Install new samba-* profiles

 -- intrigeri <intrigeri@debian.org>  Mon, 25 Jul 2022 13:46:44 +0000

apparmor (3.0.4-3ubuntu1) kinetic; urgency=medium

  * Merge from Debian unstable; remaining changes:
    - Ubuntu specific changes:
      - d/p/u/communitheme-snap-support.patch
      - d/p/u/mimeinfo-snap-support.patch
      - d/p/u/profiles-grant-access-to-systemd-resolved.patch
      - d/p/u/enable-pinning-of-pre-AppArmor-3.x-poli.patch
      - d/p/u/regression-tests-fix-aa_policy_cache-when-using-syst.patch
      - d/p/u/samba-systemd-interaction.patch
      - d/p/u/abstraction-exo-open-Remove-dbus-deny-rule.patch
    - d/{control,gbp.conf}:
      - Update Vcs / git branch for ubuntu
    - d/apparmor.install:
      - Disable debian feature pinning
    - d/rules:
      - Disable lto builds
  * Dropped Ubuntu specific changes which have now been added by Debian:
    - d/p/u/abstractions-nss-systemd-Allow-access-for-systemd-ma.patch
  * Drop unnecessary libnss-systemd patch as this is already present in
    the nss-systemd abstraction
    - d/p/u/libnss-systemd.patch

 -- Alex Murray <alex.murray@canonical.com>  Tue, 12 Jul 2022 17:02:14 +0930

apparmor (3.0.4-3) unstable; urgency=medium

  * Cherry-pick 7 patches from upstream apparmor-3.0 branch (Closes: #1003153)
  * Adjust overrides for recent Lintian
  * Override Lintian false positives

 -- intrigeri <intrigeri@debian.org>  Wed, 06 Jul 2022 07:48:25 +0000

apparmor (3.0.4-2ubuntu3) kinetic; urgency=medium

  * Add upstream commit to remove dbus deny rule from exo-open abstraction
    to fix evince startup
    (LP: #1969896)
    - d/p/u/abstraction-exo-open-Remove-dbus-deny-rule.patch

 -- Alex Murray <alex.murray@canonical.com>  Fri, 17 Jun 2022 20:34:25 +0930

apparmor (3.0.4-2ubuntu2) jammy; urgency=medium

  * Update abstractions/nss-systemd to add support for systemd-machined
    (LP: #1964325)
    - d/p/u/abstractions-nss-systemd-Allow-access-for-systemd-ma.patch
  * Drop unnecessary libnss-systemd patch as this is already present in
    the nss-systemd abstraction
    - d/p/u/libnss-systemd.patch (dropped)

 -- Alex Murray <alex.murray@canonical.com>  Thu, 10 Mar 2022 12:05:06 +1030

apparmor (3.0.4-2ubuntu1) jammy; urgency=medium

  * Merge from Debian unstable; remaining changes:
    - Ubuntu specific changes:
      - d/p/u/communitheme-snap-support.patch
      - d/p/u/enable-pinning-of-pre-AppArmor-3.x-poli.patch
      - d/p/u/libnss-systemd.patch
      - d/p/u/mimeinfo-snap-support.patch
      - d/p/u/profiles-grant-access-to-systemd-resolved.patch
      - d/p/u/regression-tests-fix-aa_policy_cache-when-using-syst.patch
      - d/p/u/samba-systemd-interaction.patch
    - d/{control,gbp.conf}:
      - Update Vcs / git branch for ubuntu
    - d/apparmor.install:
      - Disable debian feature pinning
    - d/rules:
      - Disable lto builds
  * Dropped changes:
    - d/p/ubuntu/fix-test-aa-notify.patch

 -- Alex Murray <alex.murray@canonical.com>  Thu, 24 Feb 2022 12:05:11 +1030

apparmor (3.0.4-2) unstable; urgency=medium

  * Add upstream commit that makes the test suite compatible with Python 3.10

 -- intrigeri <intrigeri@debian.org>  Wed, 23 Feb 2022 09:48:59 +0000

apparmor (3.0.4-1ubuntu1) jammy; urgency=medium

  * Merge from Debian unstable; remaining changes:
    - Drop the following patches that have been included in the upstream
      release or which Debian has also included:
      - d/p/ubuntu/adjust-for-ibus-1.5.22.patch
      - d/p/ubuntu/0011-add-mctp-network-protocol.patch
    - Refresh
      d/p/regression-tests-fix-aa_policy_cache-when-using-syst.patch to the
      official version from upstream
    - d/p/u/samba-systemd-interaction.patch: allow smbd to interact with
      systemd
    - d/p/u/libnss-systemd.patch: allow accessing the libnss-systemd
      VarLink sockets and DBus APIs
    - Disable lto builds
    - Fix autotest test-aa-notify.py
      - d/p/ubuntu/fix-test-aa-notify.patch
    - Drop outdated lintian-overrides

 -- Alex Murray <alex.murray@canonical.com>  Tue, 22 Feb 2022 10:13:44 +1030

apparmor (3.0.4-1) unstable; urgency=medium

  * New upstream release
  * apparmor-profiles: install new samba-bgqd profile
  * Drop backported patches that are now obsolete
  * debian/allow-access-to-ibus-socket.patch: drop support for pre-Bullseye
    ibus path
  * Declare compliance with Policy 4.6.0.1
  * Drop XS- prefix for adopted Python-Version control field
  * Add new symbols

 -- intrigeri <intrigeri@debian.org>  Sat, 12 Feb 2022 12:34:23 +0000

apparmor (3.0.3-6) unstable; urgency=medium

  * debian/rules: let "set -e" take effect (Closes: #998843)
  * Add support for Python 3.10 (Closes: #998686):
    - upstream-ab4cfb5e-replace-distutils-with-setuptools.patch: new patch,
      edited to drop changes to upstream .gitignore.
    - Add build-dependency on python3-setuptools

 -- intrigeri <intrigeri@debian.org>  Thu, 18 Nov 2021 09:15:55 +0000

apparmor (3.0.3-5) unstable; urgency=medium

  [ Debian Janitor ]
  * Remove constraints unnecessary since stretch.

  [ Helmut Grohne ]
  * Make the package cross-buildable (Closes: #984582):
    - Multiarchify python Build-Depends
    - Let dh_auto_build pass cross tools to make
    - Annotate perl build-dependency with !nocheck

  [ intrigeri ]
  * Remove obsolete libapparmor-perl on upgrade

 -- intrigeri <intrigeri@debian.org>  Sat, 23 Oct 2021 10:22:04 +0000

apparmor (3.0.3-4) unstable; urgency=medium

  * Merge apparmor-easyprof into apparmor-utils (Closes: #972880)
  * Make apparmor-utils and python3-apparmor arch:all (Closes: #972881)

 -- intrigeri <intrigeri@debian.org>  Sun, 17 Oct 2021 17:23:17 +0000

apparmor (3.0.3-3) unstable; urgency=medium

  * Adjust gbp.conf and Vcs-* control fields for 3.0.x now being in sid.
  * Stop building the libapparmor-perl binary package (Closes: #993565)
  * Update Lintian overrides
  * Add B-D on dh-sequence-python3, to workaround #996089 in Lintian
  * B-D: python3-all → python3-all:any, to appease Lintian

 -- intrigeri <intrigeri@debian.org>  Wed, 13 Oct 2021 05:56:16 +0000

apparmor (3.0.3-2) unstable; urgency=medium

  * Upload to unstable

 -- intrigeri <intrigeri@debian.org>  Fri, 03 Sep 2021 08:23:30 +0000

apparmor (3.0.3-1) experimental; urgency=medium

  * New upstream release
  * Drop debian/Revert-libapparmor-fixing-setup.py-call-when-crosscompili.patch:
    obsolete
  * Refresh patches
  * Merge changes from sid, up to 2.13.6-10
  * upstream-6cfc6eee-python-3.10.patch: new patch,
    for compatibility with Python 3.10

 -- intrigeri <intrigeri@debian.org>  Mon, 23 Aug 2021 18:25:14 +0000

apparmor (3.0.3-0ubuntu9) jammy; urgency=medium

  * fix test-aa-notify.py and test-network.py autotests (LP: #1961196):
    - debian/patches/ubuntu/0010-fix-test-aa-notify-help-check.patch
    - debian/patches/ubuntu/0011-add-mctp-network-protocol.patch

 -- Andrea Righi <andrea.righi@canonical.com>  Thu, 17 Feb 2022 12:18:31 +0000

apparmor (3.0.3-0ubuntu7) jammy; urgency=medium

  * No-change rebuild to update maintainer scripts, see LP: 1959054

 -- Dave Jones <dave.jones@canonical.com>  Wed, 16 Feb 2022 16:44:45 +0000

apparmor (3.0.3-0ubuntu6) jammy; urgency=medium

  * No-change rebuild for the perl update.

 -- Matthias Klose <doko@ubuntu.com>  Sun, 06 Feb 2022 13:39:44 +0100

apparmor (3.0.3-0ubuntu5) jammy; urgency=medium

  [ intrigeri ]
  * upstream-6cfc6eee-python-3.10.patch: new patch,
    for compatibility with Python 3.10
  * debian/rules: let "set -e" take effect (Closes: #998843)
  * Add support for Python 3.10 (Closes: #998686):
    - upstream-ab4cfb5e-replace-distutils-with-setuptools.patch: new patch,
      edited to drop changes to upstream .gitignore.
    - Add build-dependency on python3-setuptools

 -- Graham Inggs <ginggs@ubuntu.com>  Fri, 10 Dec 2021 12:32:27 +0000

apparmor (3.0.3-0ubuntu4) jammy; urgency=medium

  * d/p/u/samba-systemd-interaction.patch: allow smbd to interact with
    systemd (LP: #1952242):
    - allow notify access
    - allow specific /proc access
    - allow ptrace read

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 29 Nov 2021 14:43:28 +0000

apparmor (3.0.3-0ubuntu3) jammy; urgency=medium

  * No-change rebuild with fixed py3versions

 -- Graham Inggs <ginggs@ubuntu.com>  Sat, 06 Nov 2021 08:23:55 +0000

apparmor (3.0.3-0ubuntu2) jammy; urgency=medium

  * No-change rebuild to add python3.10.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 16 Oct 2021 09:34:02 +0200

apparmor (3.0.3-0ubuntu1) impish; urgency=medium

  * New upstream release 3.0.3
    - Fix regression tests when using system installed parser
      + d/p/ubuntu/regression-tests-fix-aa_policy_cache-when-using-syst.patch
    - Drop the following patches that have been included in the upstream
      release:
      + d/p/ubuntu/lp1891338.patch
      + d/p/ubuntu/lp1889699.patch
      + d/p/ubuntu/lp1881357.patch
      + d/p/ubuntu/parser-Fix-warning-message-when-complain-mode-is-for.patch
      + d/p/ubuntu/parser-Add-support-for-cap-checkpoint-restore.patch
      + d/p/ubuntu/Add-CAP_CHECKPOINT_RESTORE-to-severity.db.patch
      + d/p/ubuntu/lp1934005.patch
      + d/p/ubuntu/lp1932331.patch

 -- Alex Murray <alex.murray@canonical.com>  Mon, 09 Aug 2021 15:53:39 +0930

apparmor (3.0.1-6) experimental; urgency=medium

  * autopkgtest: use hint-testsuite-triggers to ensure dummy test is not run

 -- intrigeri <intrigeri@debian.org>  Fri, 02 Apr 2021 11:38:16 +0000

apparmor (3.0.1-5) experimental; urgency=medium

  * Merge changes from sid, up to 2.13.6-9

 -- intrigeri <intrigeri@debian.org>  Fri, 12 Feb 2021 14:37:24 +0000

apparmor (3.0.1-4) experimental; urgency=medium

  * apparmor: drop obsolete dependency on python3 (#981442)
  * Merge changes from sid, up to 2.13.6-7

 -- intrigeri <intrigeri@debian.org>  Fri, 05 Feb 2021 06:48:41 +0000

apparmor (3.0.1-3) experimental; urgency=medium

  * Supersede failed, incomplete dgit upload

 -- intrigeri <intrigeri@debian.org>  Sun, 27 Dec 2020 10:44:24 +0000

apparmor (3.0.1-2) experimental; urgency=medium

  * Supersede failed, incomplete dgit upload

 -- intrigeri <intrigeri@debian.org>  Sun, 27 Dec 2020 10:16:16 +0000

apparmor (3.0.1-1) experimental; urgency=medium

  * New upstream release
  * Vcs-* control fields: track the debian/experimental branch
  * Drop upstream-commit-*.patch: included in 3.0.1
  * Refresh patches
  * Add aa_features_new_from_file to symbols file
  * Pin the Linux 5.9 feature set
  * Only pin the policy ABI, not the kernel ABI

 -- intrigeri <intrigeri@debian.org>  Sun, 27 Dec 2020 09:23:01 +0000

apparmor (3.0.0-1) experimental; urgency=medium

  * New upstream release (Closes: #930031)
  * Merge ubuntu/3.0.0-0ubuntu1:
    - Drop upstreamed patches
    - d/apparmor.install:
      + install new aa-features-abi binary to /usr/bin
      + include abi/ directory and tunables/etc.
    - d/apparmor.manpages:
      + install new aa-features-abi.1 manpage
      + install apparmor_xattrs.7 manpage
    - d/apparmor-profiles.install:
      + install new usr.lib.dovecot.script-login
      + adjust for renamed postfix profiles
      + add usr.bin.dumpcap to extra-profiles
      + remove usr.sbin.nmbd and usr.sbin.smbd from extra-profiles
        (already in apparmor-profiles)
    - d/control:
      + apparmor-utils: drop perl dependency
      + Update apparmor-notify dependencies: it was ported to Python
    - d/tests/test-installed:
      + include libraries/ in workdir so tests have access to private
        headers
    - New patches:
      + d/p/u/parser-Fix-warning-message-when-complain-mode-is-for.patch:
        Provide better message about caching not happening due to a profile
        being in force-complain mode. (LP: #1899218)
      + d/p/ubuntu/lp1891338.patch: adjust ubuntu-integration to use
        abstractions/exo-open (LP: #1891338)
      + d/p/ubuntu/lp1889699.patch: adjust to support brave in ubuntu
        abstractions (LP: #1889699)
      + d/p/ubuntu/lp1881357.patch: adjust for new ICEauthority path in /run
        (LP: #1881357)
  * Drop another already upstreamed patch
  * Upstream the patches added by Ubuntu
  * New patches:
    - upstream-commit-9350038-add-CAP_CHECKPOINT_RESTORE.patch:
      fixes FTBFS on Linux 5.9
    - upstream-commit-5958930-add-_aa_asprintf-to-private-symbols.patch:
      fixes symbols discrepancy
    - upstream-commit-51144b5-apparmor_xattrs.7-fix-whatis-entry.patch
    - upstream-commit-11d1f38-Fix-typos.patch
    - debian/Revert-libapparmor-fixing-setup.py-call-when-crosscompili.patch:
      fixes passing hardening LDFLAGS to Python build
  * apparmor-profiles: install new php-fpm profile
  * Tell dh_missing that we purposely don't ship the chromium-browser profile
  * Override a Lintian false positive

 -- intrigeri <intrigeri@debian.org>  Sun, 25 Oct 2020 12:03:26 +0000

apparmor (3.0.0-0ubuntu9) impish; urgency=medium

  * Make X11 socket writable again (LP: #1934005):
    - d/p/ubuntu/lp1934005.patch

  * Fix i18n.sh regression test on arm64 (LP: #1932331)
    - d/p/ubuntu/lp1932331.patch

 -- Thomas Ward <teward@ubuntu.com>  Wed, 30 Jun 2021 17:31:12 -0400

apparmor (3.0.0-0ubuntu8) impish; urgency=medium

  [ Andrea Righi ]
  * add support for CAP_CHECKPOINT_RESTORE in /etc/apparmor/severity.db
   (LP: #1923432):
    - d/p/ubuntu/Add-CAP_CHECKPOINT_RESTORE-to-severity.db.patch

  [ Steve Beattie ]
  * fix adt compile-test to handle the changed name of the tcpdump
    apparmor profile (LP: #1925411)
    - d/t/compile-test: test against usr.bin.tcpdump

 -- Andrea Righi <andrea.righi@canonical.com>  Mon, 12 Apr 2021 15:51:45 +0000

apparmor (3.0.0-0ubuntu7) hirsute; urgency=medium

  * Disable lto builds, not yet ready upstream.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 23 Mar 2021 12:42:52 +0100

apparmor (3.0.0-0ubuntu6) hirsute; urgency=medium

  * Backport upstream patch to support CAP_CHECKPOINT_RESTORE to fix
    failing autopkgtests
    - d/p/ubuntu/parser-Add-support-for-cap-checkpoint-restore.patch

 -- Alex Murray <alex.murray@canonical.com>  Wed, 24 Feb 2021 21:33:07 +1030

apparmor (3.0.0-0ubuntu5) hirsute; urgency=medium

  * No-change rebuild to drop python3.8 extensions.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 07 Dec 2020 18:39:21 +0100

apparmor (3.0.0-0ubuntu4) hirsute; urgency=medium

  * Remove kopanocore dependencies from the testsuite-triggers, to be removed.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 11 Nov 2020 12:32:09 +0100

apparmor (3.0.0-0ubuntu3) hirsute; urgency=medium

  * No-change rebuild for the perl update.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 09 Nov 2020 12:40:54 +0100

apparmor (3.0.0-0ubuntu2) hirsute; urgency=medium

  * No-change rebuild to build with python3.9 as supported.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 24 Oct 2020 10:51:45 +0200

apparmor (3.0.0-0ubuntu1) groovy; urgency=medium

  [ Alex Murray ]
  * Update to the final AppArmor 3.0 upstream release
    - d/apparmor.install:
      + install new aa-features-abi binary to /usr/bin
    - d/apparmor.manpages:
      + install new aa-features-abi.1 man page
    - d/apparmor-profiles.install:
      + install new usr.lib.dovecot.script-login
      + adjust for renamed postfix profiles
    - d/tests/test-installed:
      + include libraries/ in workdir so tests have access to private
        headers
    - Drop the following patches that were originally backported from
      upstream but are now incorporated in the final release:
      + d/p/parser-fix_cap_match.patch
      + d/p/policy-provide-example-and-base-abi-to-pin-pre-3.0-p.patch
      + d/p/parser-add-abi-warning-flags.patch
      + d/p/fix-tests-regression-apparmor-prologue-inc-settest.patch
      + d/p/fix-automatic-adding-of-rule-for-change-hat-iface.patch
      + d/p/fix-parser-to-emit-proc-attr-access-for-all-situations.patch
      + d/p/fix-change-profile-stack-abstraction.patch
      + d/p/ubuntu/stop-loading-snapd-profiles.patch

  [ Emilia Torino ]
  * d/control: adjust apparmor-notify to depends on python3-psutil and
    python3-apparmor (LP: #1899046)

  [ Steve Beattie ]
  * d/p/u/parser-Fix-warning-message-when-complain-mode-is-for.patch:
    Provide better message about caching not happening due to a profile
    being in force-complain mode. (LP: #1899218)

 -- Alex Murray <alex.murray@canonical.com>  Sun, 11 Oct 2020 16:26:32 -0700

apparmor (3.0.0~beta1-0ubuntu6) groovy; urgency=medium

  * Drop d/p/lp1824812.patch: this patch was only needed with 2.13 and not
    3.0. With AppArmor 3, the patch ends up setting SFS_MOUNTPOINT to the
    wrong directory in is_container_with_internal_policy(), which causes
    policy to always fail to load in containers. Thanks to Christian Ehrhardt
    for the analysis. (LP: #1895967)

 -- Jamie Strandboge <jamie@ubuntu.com>  Tue, 22 Sep 2020 15:10:33 +0000

apparmor (3.0.0~beta1-0ubuntu5) groovy; urgency=medium

  [ John Johansen ]
  * d/p/fix-parser-to-emit-proc-attr-access-for-all-situations.patch:
    fix-automatic-adding-of-rule-for-change-hat-iface.patch fixed the
    parser to emit rules needed for change_hat in the hat profiles but
    broke the rule being emitted for the parent profile, this fixes it for
    both so that it is emitted for any profile that is a hat or that
    contains a hat.
  * d/p/fix-change-profile-stack-abstraction.patch: fix the change_profile
    abstraction so that it allows access to the apparmor attribute paths
    under LSM stacking.

 -- Alex Murray <alex.murray@canonical.com>  Fri, 18 Sep 2020 11:58:59 +0930

apparmor (3.0.0~beta1-0ubuntu2) groovy; urgency=medium

  [ John Johansen ]
  * d/p/fix-automatic-adding-of-rule-for-change-hat-iface.patch: fix
    parser not adding a rule to profiles if they are a hat or contain hats
    granting write access to the kernel interfaces.

 -- Emilia Torino <emilia.torino@canonical.com>  Thu, 17 Sep 2020 12:40:09 -0300

apparmor (3.0.0~beta1-0ubuntu1) groovy; urgency=medium

  [ John Johansen ]
  * New upstream release (LP: #1895060, LP: #1887577, LP: #1880841)
  * Drop all patches backported from upstream: applied in 3.0
  * d/p/policy-provide-example-and-base-abi-to-pin-pre-3.0-p.patch: provide
    example and base abi to pin pre 3.0 policy
  * d/p/ubuntu/enable-pinning-of-pre-AppArmor-3.x-poli.patch: enable pinning
    of pre AppArmor 3.x policy
  * drop d/p/debian/dont-include-site-local-with-dovecot.patch: no longer
    needed with upstream 'include if exists'

  [ Steve Beattie ]
  * d/p/parser-fix_cap_match.patch: fix cap match to work correctly, important
    now that groovy has a 5.8 kernel.
  * d/apparmor-profiles.install:
    + adjust for renamed postfix profiles
    + add usr.bin.dumpcap and usr.bin.mlmmj-receive to extra-profiles
    + remove usr.sbin.nmbd and usr.sbin.smbd from extra-profiles (already in
      apparmor-profiles)
  * d/apparmor.install: include abi/ directory and tunables/etc.
  * d/apparmor.manpages: add apparmor_xattrs.7 manpage
  * d/control:
    + apparmor-utils: no more shipped perl tools, drop perl dependency
    + apparmor-notify: aa-notify was converted to python3 from perl; adjust
      -notify dependencies to compensate
  * d/p/fix-tests-regression-apparmor-prologue-inc-settest.patch:
    fix sed expression in settest()

  [ Emilia Torino ]
  * Removing Ubuntu specific chromium-browser profile. This is safe to do
    since groovy's chromium-browser deb installs the snap. If apparmor3
    is backported to 18.04 or earlier, the profile will need to be taken
    into consideration
    - d/profiles/chromium-browser: remove chromium-browser profile
    - d/apparmor-profiles.postinst: remove postinst script as it only
      contains chromium-browser related functionallity.
    - d/apparmor-profiles.postrm: remove postrm script as it only
      contains chromium-browser related functionallity.
    - d/apparmor-profiles.install: remove ubuntu-specific
      chromium-browser abstraction and profile
    - d/apparmor-profiles.lintian-overrides: remove chromium-browser
      profile lintian overrides
    - d/p/ubuntu/add-chromium-browser.patch: remove patch which added
      chrome-browser

  [ Alex Murray ]
  * d/p/policy-provide-example-and-base-abi-to-pin-pre-3.0-p.patch: refresh
    this patch with the official upstream version
  * d/p/ubuntu/enable-pinning-of-pre-AppArmor-3.x-poli.patch: refresh this
    patch to match the above
  * d/p/parser-add-abi-warning-flags.patch: enable parser warnings
    to be silenced or to be treated as errors

  [ Jamie Strandboge ]
  * d/p/adjust-for-ibus-1.5.22.patch: update ibus abstract path for ibus
    1.5.22. This can be dropped with AppArmor 3.0 final.
  * d/p/parser-add-abi-warning-flags.patch: refresh to avoid lintian warnings
  * d/p/ubuntu/lp1891338.patch: adjust ubuntu-integration to use
    abstractions/exo-open (LP: #1891338)
  * d/p/ubuntu/lp1889699.patch: adjust to support brave in ubuntu
    abstractions. Patch thanks to François Marier (LP: #1889699)
  * d/p/ubuntu/lp1881357.patch: adjust for new ICEauthority path in /run
    (LP: #1881357)

 -- Jamie Strandboge <jamie@ubuntu.com>  Wed, 09 Sep 2020 21:48:17 +0000

apparmor (2.13.6-10) unstable; urgency=medium

  * autopkgtest: use hint-testsuite-triggers to ensure dummy test is not run
    (Closes: #954655)

 -- intrigeri <intrigeri@debian.org>  Sat, 03 Apr 2021 06:09:19 +0000

apparmor (2.13.6-9) unstable; urgency=medium

  * usr.lib.dovecot.script-login: don't include non-existent local override file
    (Closes: #982112)
  * Declare compliance with Policy 4.5.1

 -- intrigeri <intrigeri@debian.org>  Sat, 06 Feb 2021 17:07:35 +0000

apparmor (2.13.6-8) unstable; urgency=medium

  * Backport patch from upstream 3.0 series, which ports aa-status to C
    (upstream-commit-8f9046b-port-aa-status-to-c.patch), then
    drop obsolete dependency from the apparmor binary package
    on python3 (Closes: #981442)
  * Annotate test dependencies <!nocheck> (Closes: #981205).
    Thanks to Helmut Grohne <helmut@subdivi.de> for the patch!

 -- intrigeri <intrigeri@debian.org>  Fri, 05 Feb 2021 11:24:57 +0000

apparmor (2.13.6-7) unstable; urgency=medium

  * Supersede failed dgit upload.

 -- intrigeri <intrigeri@debian.org>  Fri, 15 Jan 2021 13:16:37 +0000

apparmor (2.13.6-6) unstable; urgency=medium

  * New patch:
    upstream-commit-1ba978b6-adjust-for-new-ICEauthority-path-in-run.patch
    (Closes: #980154)

 -- intrigeri <intrigeri@debian.org>  Fri, 15 Jan 2021 12:30:06 +0000

apparmor (2.13.6-5) unstable; urgency=medium

  * Supersede failed dgit upload.

 -- intrigeri <intrigeri@debian.org>  Mon, 11 Jan 2021 08:33:53 +0000

apparmor (2.13.6-4) unstable; urgency=medium

  * autopkgtest: update tcpdump profile name

 -- intrigeri <intrigeri@debian.org>  Mon, 11 Jan 2021 08:15:55 +0000

apparmor (2.13.6-3) unstable; urgency=medium

  * Only pin the policy ABI, not the kernel ABI.

    I hope this fixes the regressions, on older kernels, caused by pinning
    the Linux 5.9 feature set, that I guess is the reason behind the
    several autokpgtest regressions caused by 2.13.6-2 (debci runs
    on Linux 4.19.x).

 -- intrigeri <intrigeri@debian.org>  Mon, 28 Dec 2020 11:41:02 +0000

apparmor (2.13.6-2) unstable; urgency=medium

  * Pin the Linux 5.9 feature set

 -- intrigeri <intrigeri@debian.org>  Sun, 27 Dec 2020 10:24:57 +0000

apparmor (2.13.6-1) unstable; urgency=medium

  * New upstream release (Closes: #969114, #930031)
  * Improve long descriptions:
    - apparmor-utils: fix typos
    - libapparmor1, libapparmor-dev: don't try to list all functionality
  * autopkgtest: don't try to compile kopano policies (kopanocore is not
    in testing and was orphaned)
  * Adjust to the fact 3.0.x was released upstream and packaged in experimental:
    - debian/watch: use the Launchpad page with all downloads
    - gbp: use upstream/2.13.x as the upstream branch
  * Drop obsolete patches
  * apparmor-profiles: install usr.lib.dovecot.script-login (Closes: #972883)
  * Drop dh_perl custom invocation

 -- intrigeri <intrigeri@debian.org>  Sun, 27 Dec 2020 08:00:50 +0000

apparmor (2.13.5-1) unstable; urgency=medium

  * New upstream release (Closes: #868563, #934869, #969267)
  * Drop patches now included upstream
  * Refresh patches
  * d/apparmor.install: Install new file 'tunables/run' under '/etc/apparmor.d'
  * upstream-commit-145136f-fix-2.13-libapparmor-so-version.patch: new patch
  * Stop building on non-Linux architectures (Closes: #972049).
    Thanks to Laurent Bigonville <bigon@debian.org> for the suggestion.
  * Drop obsolete Lintian overrides
  * Update Lintian override name
  * Bump debhelper compat level to 13
  * Update symbols list
  * Install gettext translations
  * apparmor-profiles: install a few more profiles (usr.bin.mlmmj-receive,
    usr.lib.postfix.dnsblog, usr.lib.postfix.postscreen)
  * debian/not-installed: list files not installed on purpose
  * Adjust *.install source files to appease dh_missing
  * autopkgtests: don't try to test disabled Thunderbird profile
  * Merge ubuntu/2.13.3-7ubuntu6. Remaining included changes after resolving
    conflicts and dropping patches included in 2.13.{4,5}:
    - debian/control: add Breaks on snapd < 2.44.3+20.04~ since prior snapd
      versions assume that apparmor will load the snapd policy on boot

 -- intrigeri <intrigeri@debian.org>  Sat, 24 Oct 2020 17:15:28 +0000

apparmor (2.13.4-3) unstable; urgency=medium

  * apparmor-profiles: provide (upstream) bug reporting instructions
  * upstream-commit-1f319c3-systemd-userdbd-compat.patch: new patch
    (Closes: #962405)

 -- intrigeri <intrigeri@debian.org>  Tue, 16 Jun 2020 13:09:13 +0000

apparmor (2.13.4-2) unstable; urgency=medium

  * apparmor-profiles: don't ship redundant freshclam profile (Closes: #959915)
  * Apply upstream !465: fix the build with make 4.3
  * Drop unused Lintian override
  * GitLab CI:
     - allow reprotest to fail without failing the whole pipeline
     - enable diffoscope for reprotest

 -- intrigeri <intrigeri@debian.org>  Mon, 25 May 2020 09:23:21 +0000

apparmor (2.13.4-1) unstable; urgency=medium

  * New upstream release
  * Switch to HTTPS for upstream homepage URL
  * apparmor-profiles: install missing usr.lib.dovecot.stats profile
    (Closes: #953268)
  * Drop backported patches that are now obsolete.
  * Cherry-picked from Ubuntu:
     - Update ibus abstract path for ibus 1.5.22
     - debian/control: drop Breaks that were only needed for upgrades to bionic
  * Drop obsolete Lintian overrides
  * Add python3-all to Build-Depends
  * Override Lintian false positive
  * Declare compliance with Policy 4.5.0
  * Apply upstream !464: let Mesa check if the kernel supports
    the i915 perf interface

 -- intrigeri <intrigeri@debian.org>  Tue, 31 Mar 2020 08:45:58 +0000

apparmor (2.13.3-7ubuntu6) groovy; urgency=medium

  * Add missing "boot_id" rule to abstractions/nameservice. (LP: #1872564)
    - d/p/upstream-commit-454fca7-Add-run-variable.patch: Add the
      definition for the "@{run}" variable.
    - d/p/upstream-commit-ef591a67-Add-trailing-slash-to-the-run-variable-definition.patch:
      Add trailing slash to the "@{run}" variable.
    - d/p/upstream-commit-1f319c3870-abstractions-nameservice-allow-accessing-run-systemd-user.patch:
      Add a missing rule to allow systemd to access
      @{PROC}/sys/kernel/random/boot_id and @{run}/systemd/userdb.
    - d/apparmor.install: Install new file 'tunables/run' under '/etc/apparmor.d'.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 11 May 2020 09:55:16 -0400

apparmor (2.13.3-7ubuntu5) focal; urgency=medium

  * snapd 2.44.3+20.04 introduced an apparmor unit of its own to load snap
    policy in /var/lib/snapd/apparmor/profiles. As such, don't load snapd
    policy twice by not loading it in the apparmor unit (LP: 1871148)
    - ubuntu/stop-loading-snapd-profiles.patch: stop loading snapd profiles
    - debian/control: add Breaks on snapd < 2.44.3+20.04~ since prior snapd
      versions assume that apparmor will load the snapd policy on boot
    - debian/apparmor.service: remove the now unneeded RequiresMountsFor on
      /var/lib/snapd/apparmor/profiles
  * drop ubuntu/parser-conf-no-expr-simplify.patch: Optimize=no-expr-simplify
    was added to parser.conf to mitigate slow snap policy compiles on 32bit
    ARM. These days, snapd calls apparmor_parser with "-O no-expr-simplify"
    and loads its snap policy, so drop this delta with upstream and Debian.

 -- Jamie Strandboge <jamie@ubuntu.com>  Sun, 12 Apr 2020 16:11:31 +0000

apparmor (2.13.3-7ubuntu4) focal; urgency=medium

  * debian/apparmor.service: add /var/lib/snapd/apparmor/profiles to
    RequiresMountsFor since Ubuntu's rc.apparmor.functions looks for it
    (LP: #1871148)
  * libnss-systemd.patch: allow accessing the libnss-systemd VarLink sockets
    and DBus APIs. Patch partially based on work by Simon Deziel.
    (LP: #1796911, LP: #1869024)
  * upstream-mr-424-kerberos-dot-dirs.patch: abstractions/kerberosclient:
    allow reading /etc/krb5.conf.d/
  * upstream-mr-442-gnome-user-themes.patch: gnome abstraction: allow reading
    per-user themes from $XDG_DATA_HOME (Closes: #930031)
  * upstream-mr-443-ecryptfs-dirs.patch: abstractions/base: allow read access
    to top-level ecryptfs directories (LP: #1848919)
  * upstream-mr-445-uuidd-request.patch: abstractions/base: allow read access
    to /run/uuidd/request
  * upstream-mr-464-Mesa_i915_perf_interface.patch: let Mesa check if the
    kernel supports the i915 perf interface. Patch from Debian

 -- Jamie Strandboge <jamie@ubuntu.com>  Mon, 06 Apr 2020 17:47:20 +0000

apparmor (2.13.3-7ubuntu3) focal; urgency=medium

  * Add upstream-abstractions-add-etc-mdns.allow-to-etc-apparmor.d-ab.patch
    (LP: #1869629)

 -- John Johansen <john.johansen@canonical.com>  Wed, 01 Apr 2020 01:05:30 -0700

apparmor (2.13.3-7ubuntu2) focal; urgency=medium

  * No-change rebuild to drop python3.7.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 18 Feb 2020 10:42:36 +0100

apparmor (2.13.3-7ubuntu1) focal; urgency=medium

  * Merge from Debian. Remaining changes:
    - Ubuntu-specific patches:
      + ubuntu/add-chromium-browser.patch
      + ubuntu/communitheme-snap-support.patch
      + ubuntu/mimeinfo-snap-support.patch
      + ubuntu/parser-conf-no-expr-simplify.patch
      + ubuntu/profiles-grant-access-to-systemd-resolved.patch
      + upstream-dont-allow-fontconfig-cache-write.patch
      + upstream-tests-mult-mount-bump-size-of-created-disk.patch
    - debian/apparmor.{install,maintscript}: feature pinning is not used in
      Ubuntu
    - debian/apparmor.preinst: remove cache files on upgrade to 2.13
    - debian/apparmor-profiles.install: install Ubuntu chromium-browser
      profile and abstraction
    - debian/apparmor-profiles.lintian-overrides: update for chromium-browser
      profile having read access to dpkg database for lsb-release
    - debian/apparmor-profiles.postinst: ubuntu-browsers.d/chromium-browser
      abstraction if it doesn't exist
    - debian/control: adjust the Vcs-{Browser,Git} control fields to reflect
      the branch where the Ubuntu packaging is maintained.
    - debian/gbp.conf: use ubuntu/master as the debian-branch
    - debian/patches/series: comment out debian-only patches
    - debian/tests/control and debian/tests/compile-policy: don't test
      thunderbird since the Ubuntu packaging doesn't ship a profile
  * Drop the following patches, no longer needed:
    - python3.8-ac.diff
  * debian/control: drop Breaks on media-hub, mediascanner2.0, messaging-app,
    and webbrowser-app which was needed for upgrades to bionic (LP: #1797242)
  * upstream-adjust-for-ibus-1.5.22.patch: update ibus abstract path for ibus
    1.5.22
  * upstream-adjust-gnome-for-mimeapps.patch: abstractions/gnome: also allow
    /etc/xdg/mimeapps.list (LP: #1792027)

 -- Jamie Strandboge <jamie@ubuntu.com>  Tue, 17 Dec 2019 15:50:00 +0000

apparmor (2.13.3-7) unstable; urgency=medium

  * Add explicit build dependency on dh-python, so that this package
    can built with python3-defaults 3.7.5-3.

 -- intrigeri <intrigeri@debian.org>  Fri, 15 Nov 2019 10:37:05 +0000

apparmor (2.13.3-6) unstable; urgency=medium

  [ Matthias Klose ]
  * debian/rules: ensure "set -e" is honored (Closes: #943649).
  * Add upstream-mr-430-Fix-a-Python-3.8-autoconf-check.patch (Closes: #943657).

 -- intrigeri <intrigeri@debian.org>  Tue, 29 Oct 2019 18:57:51 +0000

apparmor (2.13.3-5ubuntu5) focal; urgency=medium

  * Don't ignore exit status in debian/rules.
  * Fix a Python 3.8 autoconf check.

 -- Matthias Klose <doko@ubuntu.com>  Sun, 27 Oct 2019 16:38:00 +0200

apparmor (2.13.3-5ubuntu2) focal; urgency=medium

  * No-change rebuild for the perl update.

 -- Matthias Klose <doko@ubuntu.com>  Fri, 18 Oct 2019 19:26:58 +0000

apparmor (2.13.3-5ubuntu1) eoan; urgency=medium

  * Merge new upstream release from Debian. Remaining changes:
    - Ubuntu-specific patches:
      + ubuntu/add-chromium-browser.patch
      + ubuntu/communitheme-snap-support.patch
      + ubuntu/mimeinfo-snap-support.patch
      + ubuntu/parser-conf-no-expr-simplify.patch
      + ubuntu/profiles-grant-access-to-systemd-resolved.patch
    - debian/apparmor.{install,maintscript}: feature pinning is not used in
      Ubuntu
    - debian/apparmor.preinst: remove cache files on upgrade to 2.13
    - debian/apparmor-profiles.install: install Ubuntu chromium-browser
      profile and abstraction
    - debian/apparmor-profiles.lintian-overrides: update for chromium-browser
      profile having read access to dpkg database for lsb-release
    - debian/apparmor-profiles.postinst: ubuntu-browsers.d/chromium-browser
      abstraction if it doesn't exist
    - debian/control: adjust the Vcs-{Browser,Git} control fields to reflect
      the branch where the Ubuntu packaging is maintained.
    - debian/gbp.conf: use ubuntu/master as the debian-branch
    - debian/patches/series: comment out debian-only patches
    - debian/tests/control and debian/tests/compile-policy: don't test
      thunderbird since the Ubuntu packaging doesn't ship a profile
  * Drop the following patches, no longer needed:
    - ubuntu/dont-include-site-local-with-dovecot.patch
    - lp1820068.patch
    - upstream-commit-fix-segfault-in-overlaydirat_for_each.patch
    - upstream-commit-add-option-to-dump-policy-cache-with-libapparmor.patch
    - upstream-commit-teach-aa_policy_cache_sh-about-the-new-cache.patch
    - upstream-commit-fix-segfault-when-loading-policy-cache-files.patch
    - upstream-commit-fix-variable-name-overlap-in-merge-macro.patch
  * upstream-dont-allow-fontconfig-cache-write.patch: don't allow write of
    fontconfig cache files
  * upstream-tests-mult-mount-bump-size-of-created-disk.patch: regression
    tests/mult_mount: bump size of created disk image

 -- Jamie Strandboge <jamie@ubuntu.com>  Mon, 09 Sep 2019 19:13:22 +0000

apparmor (2.13.3-5) unstable; urgency=medium

  * upstream-mr-419-Xwayland-vs-recent-mutter.patch: new patch (Closes: #935058)

 -- intrigeri <intrigeri@debian.org>  Sun, 08 Sep 2019 08:00:56 +0000

apparmor (2.13.3-4) unstable; urgency=medium

  * New patch, cherry-picked and adapted from Ubuntu: don't include local/
    snippets in the Dovecot profiles. These inclusions of non-existing files
    break aa-genprof (Closes: #928160).
  * Merge ubuntu/2.13.2-9ubuntu7, which turns out to be a no-op, because
    we essentially revert all changes brought by this merge:
    - Drop lp1820068.patch, introduced in 2.13.2-9ubuntu7: it's included
      in the 2.13.3 upstream release already.
    - Don't enable ubuntu/parser-conf-no-expr-simplify.patch, that Ubuntu just
      re-enabled: in Debian we don't disable expression tree simplification,
      because we've cherry-picked an upstream patch that improves its
      performance sufficiently.

 -- intrigeri <intrigeri@debian.org>  Sat, 27 Jul 2019 17:18:43 +0000

apparmor (2.13.3-3) unstable; urgency=medium

  [ Michael Biebl ]
  * Move libraries back to /usr/lib

  [ intrigeri ]
  * Remove Lintian override made obsolete by the move to /usr/lib/apparmor/
  * Avoid-blhc-CPPFLAGS-missing-false-positive.patch: new patch.
  * Revert "debian/control: Breaks on snapd < 2.38~"
    Jamie Strandboge explained in details on #932815 the rationale behind this
    Breaks relationship. The user impact seems non-critical and the risk of the
    problem happening in practice is very low, so for now let's remove this
    Breaks, that prevents apparmor from migrating to testing (we don't have
    snapd 2.38+ in Debian yet).

 -- intrigeri <intrigeri@debian.org>  Tue, 23 Jul 2019 22:19:02 +0000

apparmor (2.13.3-2) unstable; urgency=medium

  * Install the lsb_release profile.

 -- intrigeri <intrigeri@debian.org>  Wed, 17 Jul 2019 19:41:32 +0000

apparmor (2.13.3-1) unstable; urgency=medium

  * Import new 2.13.3 upstream release and accordingly:
    - Update dev-pkg-without-shlib-symlink Lintian override: soname
      was bumped to 1.6.1.
    - Drop patches that were applied upstream.
  * Merge ubuntu/2.13.2-9ubuntu6, dropping the Ubuntu delta (Closes: #926015):
    - lp1824812.patch: set SFS_MOUNTPOINT in is_container_with_internal_policy()
      since it is sometimes called independently of is_apparmor_loaded()
      (LP: #1824812)
    - debian/apparmor.postrm: remove parser-created subdirs
    - debian/tests/control: try Ubuntu kernel but mark skip-not-installable
    - regression testsuite fixes:
      upstream-commit-add-option-to-dump-policy-cache-with-libapparmor.patch,
      upstream-commit-teach-aa_policy_cache_sh-about-the-new-cache.patch,
      upstream-commit-fix-variable-name-overlap-in-merge-macro.patch
    - debian/debhelper/postrm-apparmor: also remove cache files
    - debian/control: Breaks on snapd < 2.38~ (the cache forest breaks snap
      remove)
  * Declare compatibility with Debian Policy 4.4.0.
  * Bump debhelper compatibility level to 12. Accordingly:
    - dh_installinit: replace --no-restart-on-upgrade with its new
      --no-stop-on-upgrade name
    - Add override_dh_installsystemd that mimics our override_dh_installinit
  * tests/compile-policy: check syntax of kopano profiles (implements
    #923313 except kopano-search, until giraffe-team/kopanocore!4 is merged
    and uploaded)

 -- intrigeri <intrigeri@debian.org>  Wed, 17 Jul 2019 17:55:09 +0000

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog apparmor`.
