apparmor (5.0.2-0ubuntu1~26.04.1) resolute; urgency=medium

  * New upstream release (SRU backport). (LP: #2161458)
  * Upstream release contains fixes for:
    - uucore locales reads (LP: #2158941)
    - lsusb uevent file reads (LP: #2158939)
    - alsamixer asound config reads (LP: #2157575)
  * d/apparmor.install: add the new glycin.* profiles
  * d/libapparmor1.symbols: add the new library symbols
  * d/rules: add profiles check to testing step
  * d/watch:
    - Update regex to handle -rc version numbers
    - Update to version 5 of the format
  * Refresh patches to apply to upstream release:
    - d/p/u/profiles-grant-access-to-systemd-resolved.patch
    - d/p/u/aa-notify-fallback-to-ev-comm-when-ev-execpath.patch
  * Update patches to apply to upstream release:
    - d/p/u/samba-systemd-interaction.patch
    - d/p/u/profiles_disable_curl.patch
    - d/p/u/profiles_add_more_consoles_workaround.patch
    - d/p/u/profiles-use-coreutils-tunable.patch
    - d/p/u/0001-parser-add-more-reserved-mediation-classes.patch
    - d/p/u/0007-Set-parser-network.h-ip_conds-ptrs-to-null-in-its-fr.patch
  * Drop patches that were applied upstream:
    - d/p/u/libapparmor-move-aa_get_lsm_iface-decl-in-libapparmor.patch
    - d/p/u/0001-parser-set-umask-before-creating-temp-file.patch
    - d/p/u/0002-parser-restrict-umask-to-allow-only-user-permissions.patch
    - d/p/u/libapparmor-add-test-for-libapparmor-features-prefix.patch
    - d/p/u/transmission-common-fixes-for-lp-2137395.patch
    - d/p/u/unix-chkpwd-add-disconnected-run-paths.patch
    - d/p/u/profiles-add-extensions-to-allowed-ghostscript.patch
    - d/p/u/profiles-expand-the-allowed-directories-for-ghostscript.patch
    - d/p/u/profiles-add-sys-kernel-mm-transparent_hugepage-enable.patch
    - d/p/u/0006-parser-name-ns_domain-and-network_v9-classes.patch
    - d/p/u/0011-utils-add-support-for-iface-an-label-in-network-rule.patch
    - d/p/u/0013-parser-fix-FTBFS-due-to-missing-merge-edit.patch
    - d/p/u/0014-tests-check-if-skb-mediation-is-enabled.patch
    - d/p/u/snap-browser-add-missing-perms-when-opening-from-link.patch
    - d/p/u/lsusb-allow-reading-etc-udev-hwdb-bin.patch
    - d/p/u/profiles-grant-unix-domain-socket-access-to-sanitize.patch
    - d/p/u/0002-parser-refactor-compressed-policy-cache.patch
    - d/p/u/0003-parser-handle-compressed-cache-on-kernels-without-de.patch
    - d/p/u/0004-regression-fix-the-e2e-test-for-compressed-caches.patch
  * Drop patches that were superseded upstream:
    - d/p/u/0002-parser-convert-conditionals-operators-to-an-enum.patch
    - d/p/u/0003-parser-add-override-assign-to-cond-list-elements.patch
    - d/p/u/0004-parser-support-network-interface-conditional.patch
    - d/p/u/0005-tests-add-network-interface-tests.patch
    - d/p/u/0008-parser-move-to-encode-an-alternation-of-a-null-trans.patch
    - d/p/u/0009-parser-disable-ability-to-specify-interface-on-peer-.patch
    - d/p/u/0010-parser-fix-iface-perms-to-work-when-v9-and-v9_skb-ar.patch
    - d/p/u/0012-parser-fix-label-match-for-default-label-values.patch
    - d/p/u/0001-parser-fix-rewriting-of-cache-after-zstd-recompressi.patch
  * Add patches to fix FTBFS (profile test enabling):
    - d/p/u/profiles-allow-more-attach-disconnected.patch
  * Update patches to fix FTBFS (profile test enabling):
    - d/p/u/openvpn_mr_1263.patch
    - d/p/u/irssi_mr_1332.patch
    - d/p/u/os_prober_mr_1569.patch
    - d/p/u/profiles_disable_free.patch
    - d/p/u/profiles_disable_curl.patch
    - d/p/u/profiles-tunables-add-coreutils-var.patch
    - d/p/u/profiles-use-coreutils-tunable.patch
    - d/p/u/profiles-pull-openvpn-profile.patch
  * Add patch to fix transmission-gtk file chooser (LP: #2152079):
    - d/p/u/profiles-add-file-chooser-rules-to-abstractions-trans.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 13 Jul 2026 10:43:46 -0700

apparmor (5.0.0~beta1-0ubuntu7) resolute; urgency=medium

  * Add patches to fix skb and v9 network iface mediation (LP: #2147551):
    - d/p/u/0006-parser-name-ns_domain-and-network_v9-classes.patch
    - d/p/u/0007-Set-parser-network.h-ip_conds-ptrs-to-null-in-its-fr.patch
    - d/p/u/0008-parser-move-to-encode-an-alternation-of-a-null-trans.patch
    - d/p/u/0009-parser-disable-ability-to-specify-interface-on-peer-.patch
    - d/p/u/0010-parser-fix-iface-perms-to-work-when-v9-and-v9_skb-ar.patch
    - d/p/u/0011-utils-add-support-for-iface-an-label-in-network-rule.patch
    - d/p/u/0012-parser-fix-label-match-for-default-label-values.patch
    - d/p/u/0013-parser-fix-FTBFS-due-to-missing-merge-edit.patch
    - d/p/u/0014-tests-check-if-skb-mediation-is-enabled.patch
  * Add patch to fix snap browser invocation from Evince and papers
    (LP: #2127874):
    - d/p/u/snap-browser-add-missing-perms-when-opening-from-link.patch
  * Add patch to pull the Rygel profile (LP: #2137088):
    - d/p/u/profiles-pull-rygel-profile.patch
  * Add patch to pull the openvpn profile (LP: #2146874):
    - d/p/u/profiles-pull-openvpn-profile.patch
  * d/apparmor.install,d/apparmor-profiles.install,d/apparmor.maintscript:
    account for the new location of the rygel and openvpn profile
  * Add patch to fix lsusb hwdb access (LP: #2148047):
    - d/p/u/lsusb-allow-reading-etc-udev-hwdb-bin.patch
  * Add patch for unix socket access in sanitized_helper (LP: #2148177):
    - d/p/u/profiles-grant-unix-domain-socket-access-to-sanitize.patch
  * Add patch to fix compressed cache mtime issues (LP: #2147986):
    - d/p/u/0001-parser-fix-rewriting-of-cache-after-zstd-recompressi.patch
    - d/p/u/0002-parser-refactor-compressed-policy-cache.patch
    - d/p/u/0003-parser-handle-compressed-cache-on-kernels-without-de.patch
    - d/p/u/0004-regression-fix-the-e2e-test-for-compressed-caches.patch
  * apparmor.postinst: remove separately generated compressed cache
    (LP: #2147986)

 -- Ryan Lee <ryan.lee@canonical.com>  Wed, 08 Apr 2026 10:26:51 -0700

apparmor (5.0.0~beta1-0ubuntu6) resolute; urgency=medium

  * d/p/u/openvpn_networkmanager_rundir.patch: fix the previous attempt to
    patch the openvpn profile (LP: #2143810)
  * Add patch to fix disconnected paths in unix-chkpwd with pkexec
    (LP: #2145628):
    - d/p/u/unix-chkpwd-add-disconnected-run-paths.patch
  * Add patch to fix list of allowed ghostscript extensions (LP: #2139339):
    - d/p/u/profiles-add-extensions-to-allowed-ghostscript.patch
  * Add patch to expand allowed ghostscript locations (LP: #2144896):
    - d/p/u/profiles-expand-the-allowed-directories-for-ghostscript.patch
  * Add patch for capabilities needed by OpenVPN DCO (LP: #2146980):
    - d/p/u/openvpn-fix-dco.patch
  * Add patch for transparent huge page support detection (LP: #2147031):
    - d/p/u/profiles-add-sys-kernel-mm-transparent_hugepage-enable.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Tue, 31 Mar 2026 10:52:03 -0700

apparmor (5.0.0~beta1-0ubuntu5) resolute; urgency=medium

  * Add patches for network iface mediation in the parser (LP: #2144679):
    - d/p/u/0001-parser-add-more-reserved-mediation-classes.patch
    - d/p/u/0002-parser-convert-conditionals-operators-to-an-enum.patch
    - d/p/u/0003-parser-add-override-assign-to-cond-list-elements.patch
    - d/p/u/0004-parser-support-network-interface-conditional.patch
    - d/p/u/0005-tests-add-network-interface-tests.patch
  * debian/control: add socat test dependency to Build-Depends

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 19 Mar 2026 08:46:13 -0700

apparmor (5.0.0~beta1-0ubuntu4) resolute; urgency=medium

  * Add patch from upstream to fix transmission (LP: #2137395)
    - d/p/u/transmission-common-fixes-for-lp-2137395.patch

 -- Alex Murray <murray.alex@gmail.com>  Wed, 18 Mar 2026 23:02:41 +1030

apparmor (5.0.0~beta1-0ubuntu3) resolute; urgency=medium

  * Add patch to fix openvpn loading of NetworkManager copied certificates
    after CVE-2025-9615 fix (LP: #2143810):
    - d/p/u/openvpn_networkmanager_rundir.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Wed, 11 Mar 2026 11:33:40 -0700

apparmor (5.0.0~beta1-0ubuntu2) resolute; urgency=medium

  * Add patch to fix libapparmor Python aa_get_lsm_iface binding
    (LP: #2142788):
    - d/p/u/libapparmor-move-aa_get_lsm_iface-decl-in-libapparmor.patch
  * Add patches to fix parser tempfile umask (LP: #2142885):
    - d/p/u/0001-parser-set-umask-before-creating-temp-file.patch
    - d/p/u/0002-parser-restrict-umask-to-allow-only-user-permissions.patch
  * Add test for libapparmor feature prefix parse issue (LP 2105986):
    - d/p/u/libapparmor-add-test-for-libapparmor-features-prefix.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Fri, 27 Feb 2026 09:48:42 -0800

apparmor (5.0.0~beta1-0ubuntu1) resolute; urgency=medium

  [ Alessandro Astone ]
  * d/tests: Update libreoffice profile names

  [ Ryan Lee ]
  * New upstream release.
  * debian/control: add libzstd-dev to list of dependencies
  * debian/libapparmor1.symbols: Add new libapparmor symbols to file
  * Refresh patches to apply to new release:
    - d/p/u/communitheme-snap-support.patch
    - d/p/u/profiles-grant-access-to-systemd-resolved.patch
  * Drop patches that were superseded upstream:
    - d/p/u/parser-fix-pam_apparmor-regression-test-failures.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 19 Feb 2026 09:57:16 -0800

apparmor (5.0.0~alpha6-0ubuntu1) resolute; urgency=medium

  * New upstream release.
  * Update patches to apply to new release:
    - d/p/d/Enable-writing-cache.patch
    - d/p/u/Move-the-bwrap-userns-restrict-profile-out-of-extras.patch
    - d/p/u/delete-the-busybox-and-nautilus-profiles.patch
    - d/p/u/profiles_remove_hwctl.patch
    - d/p/u/profiles_disable_free.patch
    - d/p/u/profiles_disable_curl.patch
    - d/p/u/profiles_add_more_consoles_workaround.patch
    - d/p/u/profiles-use-coreutils-tunable.patch
  * Refresh patches to apply to new release:
    - d/p/u/parser-fix-pam_apparmor-regression-test-failures.patch
    - d/p/u/aa-notify-userns-filtering.patch
    - d/p/u/aa-notify-fallback-to-ev-comm-when-ev-execpath.patch
  * Drop patches that were applied upstream:
    - d/p/u/userns-runtime-disable.patch
    - d/p/u/userns-runtime-disable-fix-for-6_14.patch
    - d/p/u/parser-fix-variable-expansion.patch
    - d/p/u/nss-systemd-grant-access-to-gdm-user-db.patch
    - d/p/u/parser-fix-misc-leaks.patch
    - d/p/u/parser-fix-more-parser-leaks.patch
    - d/p/u/curl_read_tmp.patch
    - d/p/u/curl_access_snapd_socket.patch
    - d/p/u/unix_chkpwd_authd.patch
    - d/p/u/profiles_dig_add_abstractions_consoles.patch
    - d/p/u/profiles_fix_systemd_detect_virt_new_denials.patch
    - d/p/u/profiles_expand_libnuma_abstraction
    - d/p/u/regression_disconnected_mount_complain_danglings.patch
    - d/p/u/regression_disconnected_mount_complain_fix_6_15.patch
    - d/p/u/utils_test_aa_show_usage_handle_disabled.patch
    - d/p/u/profiles-add-rules-for-pam-extrausers.so-to-unix-chkpwd.patch
    - d/p/u/parser_libapparmor_re_fix_inconsistent_build.patch
    - d/p/u/parser_libapparmor_re_fix_implied_m.patch
    - d/p/u/0001-tests-regression-Update-socketpair-test-for-upstream.patch
    - d/p/u/0002-tests-regression-update-socketpair-tests-to-detect-d.patch
    - d/p/u/0003-tests-regression-update-socketpair-tests-to-detect-d.patch
    - d/p/u/0004-tests-regressions-Improve-output-of-require_any_of_k.patch
    - d/p/u/0005-tests-regression-update-network-requirements-for-v9.patch
    - d/p/u/0006-regression-tests-update-logic-to-support-v9-af_unix-.patch
    - d/p/u/0007-tests-regressions-Fix-socket-pair-for-v7-semantics.patch
    - d/p/u/parser-fix-unix-addresses-with-alternations.patch
    - d/p/u/profiles-add-rules-to-fix-flatpaks-with-fuse3-17.patch
    - d/p/u/profiles-grant-netrc-read-access-to-tnftp.patch
    - d/p/u/profiles-systemd-detect-virt-handle-device-tree-folder.patch
    - d/p/u/lsblk_read_access_azure_acpi.patch
    - d/p/u/regression-fix-for-rust-coreutils.patch
    - d/p/u/utils-remove-global-_-from-aa-notify-main.patch
    - d/p/u/0001-libapparmor-change-setup.py-to-remove-the-need-for-_.patch
    - d/p/u/0002-libapparmor-remove-__init__.py-not-needed-for-SWIG-P.patch
    - d/p/u/utils-test-use-sys.executable-when-launching-aa-show.patch
  * d/apparmor.install, d/not-installed: account for new location
    of init scripts
  * d/rules:
    - account for new locatin of init scripts
    - specify LD_LIBRARY_PATH during testing to use locally built
      libapparmor for libapparmor.so
  * d/watch: point towards GitLab tarballs instead and update regexes
  * debian/apparmor-profiles.install: account for remmina profile being
    moved to extra-profiles upstream

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 09 Feb 2026 11:15:02 -0800

apparmor (5.0.0~alpha1-0ubuntu11) resolute; urgency=medium

  * Add patch to fix utils flake8 FTBFS:
    - d/p/u/utils-remove-global-_-from-aa-notify-main.patch
  * Add patches to fix python3-libapparmor FTBFS:
    - d/p/u/0001-libapparmor-change-setup.py-to-remove-the-need-for-_.patch
    - d/p/u/0002-libapparmor-remove-__init__.py-not-needed-for-SWIG-P.patch
  * Add patch to fix utils testing with non-default Python:
    - d/p/u/utils-test-use-sys.executable-when-launching-aa-show.patch
  * debian/python3-libapparmor.install: include new location of Python
    _LibAppArmor*.so libraries
  * debian/rules:
    - revert hardcoding of python3.13 as workaround of
      python3.14-tk breakage
    - remove __pycache__ directory generated by python3-libapparmor build

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 26 Jan 2026 11:08:37 -0800

apparmor (5.0.0~alpha1-0ubuntu10) resolute; urgency=medium

  * Another no-change rebuild with Python 3.14 for amd64v3

 -- Graham Inggs <ginggs@ubuntu.com>  Sun, 18 Jan 2026 18:35:09 +0000

apparmor (5.0.0~alpha1-0ubuntu9) resolute; urgency=medium

  * debian/rules: temporarily hardcode python3.13 only for utils to
    work around python3.14-tk breakage
  * Add patch to grant netrc access to tnftp (LP: #2127491):
    - d/p/u/profiles-grant-netrc-read-access-to-tnftp.patch
  * Add patch to fix device tree scan by systemd-detect-virt (LP: #2127111)
    - d/p/u/profiles-systemd-detect-virt-handle-device-tree-folder.patch
  * Add patch to allow lsblk reading of Azure NVMe ACPI (LP: #2126920):
    - d/p/u/lsblk_read_access_azure_acpi.patch
  * Add patch to fix errors in regression tests with Rust coreutils
    (LP: #2129779):
    - d/p/u/regression-fix-rust-coreutils.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 20 Oct 2025 11:10:39 -0700

apparmor (5.0.0~alpha1-0ubuntu8.2) resolute; urgency=medium

  * No-change rebuild with Python 3.14 as supported version

 -- Graham Inggs <ginggs@ubuntu.com>  Sun, 19 Oct 2025 12:00:44 +0000

apparmor (5.0.0~alpha1-0ubuntu8.1) questing; urgency=medium

  * Add patch to fix Flatpak breakage caused by fusermount3 denials
    (LP: #2122161):
    - d/p/u/profiles-add-rules-to-fix-flatpaks-with-fuse3-17.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 09 Oct 2025 10:44:07 -0700

apparmor (5.0.0~alpha1-0ubuntu8) questing; urgency=medium

  * Add patch to allow technically invalid @{.,.} alternations in profiles
    (LP: #2126450):
    - d/p/u/parser-fix-unix-addresses-with-alternations.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Tue, 30 Sep 2025 11:06:26 -0700

apparmor (5.0.0~alpha1-0ubuntu7) questing; urgency=medium

  * Add profile patches to support both GNU and Rust coreutils
    (LP: #2122633, LP: #2123870):
    - d/p/u/profiles-tunables-add-coreutils-var.patch
    - d/p/u/profiles-use-coreutils-tunable.patch
  * Add patches to fix socketpair QRT test (LP: #2124206):
    - d/p/u/0001-tests-regression-Update-socketpair-test-for-upstream.patch
    - d/p/u/0002-tests-regression-update-socketpair-tests-to-detect-d.patch
    - d/p/u/0003-tests-regression-update-test-requires-for-v9-af_unix.patch
    - d/p/u/0004-tests-regressions-Improve-output-of-require_any_of_k.patch
    - d/p/u/0005-tests-regression-update-network-requirements-for-v9.patch
    - d/p/u/0006-regression-tests-update-logic-to-support-v9-af_unix-.patch
    - d/p/u/0007-tests-regressions-Fix-socket-pair-for-v7-semantics.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 15 Sep 2025 14:15:56 -0700

apparmor (5.0.0~alpha1-0ubuntu6) questing; urgency=medium

  * Add patches to fix nondeterministic profile builds (LP: #2122086):
    - d/p/u/parser_libapparmor_re_fix_inconsistent_build.patch
    - d/p/u/parser_libapparmor_re_fix_implied_m.patch
  * Add patch to add console access to more profiles (LP: #2122536):
    - d/p/u/profiles_add_more_consoles_workaround.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Tue, 09 Sep 2025 15:19:03 -0700

apparmor (5.0.0~alpha1-0ubuntu5) questing; urgency=medium

  * Add patch to disable the free profile (LP: #2121552):
    - d/p/u/profiles_disable_free.patch
  * Add patch to disable the curl profile (LP: #2121552):
    - d/p/u/profiles_disable_curl.patch
  * Add patch to add console access to the dig profile (LP: #2121401):
    - d/p/u/profiles_dig_add_abstractions_consoles.patch
  * Add patch to fix systemd-detect-virt new denials (LP: #2121248):
    - d/p/u/profiles_fix_systemd_detect_virt_new_denials.patch
  * Add patch to the libnuma abstraction for active usage (LP: #2122088):
    - d/p/u/profiles_expand_libnuma_abstraction.patch
  * Add patches to fix disconnected_mount_complain regression test on
    kernel 6.15 or later (LP: #2122087):
    - d/p/u/regression_disconnected_mount_complain_danglings.patch
    - d/p/u/regression_disconnected_mount_complain_fix_6_15.patch
  * Add patch to fix aa-show-usage test's handling of disabled profiles
    (LP: #2122089):
    - d/p/u/utils_test_aa_show_usage_handle_disabled.patch
  * Add patch for pam_extrausers.so usage in unix-chkpwd (LP: #2121875):
    - d/p/u/profiles-add-rules-for-pam-extrausers.so-to-unix-chkpwd.patch
  * apparmor.install, apparmor-profiles.install: move install lines for
    free and curl to apparmor-profiles
  * apparmor.maintscript: handle disabling of free and curl profiles
  * debian/tests/compile-policy, debian/tests/control: switch from ntp to
    chrony (LP: #2122143)

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 04 Sep 2025 12:24:37 -0700

apparmor (5.0.0~alpha1-0ubuntu4) questing; urgency=medium

  * Add a patch to grant curl read access to tmp (LP: #2119237):
    - d/p/u/curl_read_tmp.patch
  * Add a patch to grant curl access to a snapd socket (LP: #2120669):
    - d/p/u/curl_access_snapd_socket.patch
  * Add a patch to grant unix_chkpwd access to authd (LP: #2120221):
    - d/p/u/unix_chkpwd_authd.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 18 Aug 2025 17:07:46 -0700

apparmor (5.0.0~alpha1-0ubuntu3) questing; urgency=medium

  * debian/apparmor.install, debian/apparmor-profiles.install,
    debian/apparmor.maintscript: disable the lsof profile by default
    as temporary workaround for LP #2120233

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 11 Aug 2025 09:38:19 -0700

apparmor (5.0.0~alpha1-0ubuntu2) questing; urgency=medium

  * Add a patch to grant nss-systemd access to new GDM userdb service:
    (LP: #2119541)
    - d/p/u/nss-systemd-grant-access-to-gdb-user-db.patch
  * Add a patch to improve aa-notify command notification fallback:
    - d/p/u/aa-notify-fallback-to-ev-comm-when-ev-execpath.patch
  * Add patches to fix parser memory leaks:
    - d/p/u/parser-fix-misc-leaks.patch
    - d/p/u/parser-fix-more-parser-leaks.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 07 Aug 2025 18:07:17 -0700

apparmor (5.0.0~alpha1-0ubuntu1) questing; urgency=medium

  * New upstream release.
  * Add a patch to fix parser variable expansion:
    - d/p/u/parser-fix-variable-expansion.patch
  * Add patch to remove hwctl profile from our packaging:
    - d/p/u/profiles_remove_hwctl.patch
  * Updated patches to apply to the new release:
    - d/p/u/communitheme-snap-support.patch
    - d/p/u/parser-fix-pam_apparmor-regression-test-failures.patch
    - d/p/u/delete-the-busybox-and-nautilus-profiles.patch
  * Refreshed patches to apply to the new release:
    - d/p/u/profiles-grant-access-to-systemd-resolved.patch
    - d/p/u/aa-notify-userns-filtering.patch
  * Dropped patches that were superseded upstream:
    - d/p/u/lsblk_mr_1437.patch
    - d/p/u/lsusb_mr_1433.patch
    - d/p/u/lsusb_profile_fixup.patch
    - d/p/u/lsblk_sudo_and_tree.patch
    - d/p/u/remmina_mr_1348.patch
    - d/p/u/remmina-dbus-describeall.patch
    - d/p/u/rygel_mr_1311.patch
    - d/p/u/socat_mr_1319.patch
    - d/p/u/tnftp_mr_1363.patch
    - d/p/u/znc_mr_1376.patch
    - d/p/u/tshark_mr_1384.patch
    - d/p/u/wireguard_mr_1323.patch
    - d/p/u/netcat-openbsd_mr_1327.patch
    - d/p/u/tar_mr_1453.patch
    - d/p/u/tar_cap_fowner_fix_mr_1553.patch
    - d/p/u/alsamixer_mr_1517.patch
    - d/p/u/tinyproxy_mr_1477.patch
    - d/p/u/frr_mr_1380.patch
    - d/p/u/iotop_c_mr_1520.patch
    - d/p/u/wpa_supplicant_mr_1385.patch
    - d/p/u/wpa_supplicant_profile_fixup.patch
    - d/p/u/fusermount3_mr_1514.patch
    - d/p/u/curl_mr_1560.patch
  * Dropped patches that were applied upstream:
    - d/p/u/mbsync_mr_1372.patch
    - d/p/u/dnstracer_mr_1366.patch
    - d/p/u/mosquitto_mr_1506.patch
    - d/p/u/libapparmor-swig-perl-typemaps.patch
    - d/p/u/0001-utils-read_profiles-robust-against-unparseable.patch
    - d/p/u/0002-utils-test-minitools-resiliency-against-unparsed.patch
    - d/p/u/attach_disconnected_ipc.patch
    - d/p/u/profiles_ensure_access_to_attach_path.patch
    - d/p/u/fix-incorrect-mount-flag-apparmor.d-docs.patch
    - d/p/u/regression-verify-documented-mount-flag-behavior.patch
    - d/p/u/profiles-add-libnuma-abstraction.patch
  * d/apparmor.install:
    - Remove entry for toybox profile
    - Add entries for new profiles from upstream release
  * d/apparmor-profiles.install: ensure that the remmina profile
    remains disabled by default

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 31 Jul 2025 12:45:58 -0700

apparmor (4.1.1-0ubuntu6) questing; urgency=medium

  * Add a patch to add a libnuma abstraction (LP: #2117553)
    - d/p/u/profiles-add-libnuma-abstraction.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Wed, 23 Jul 2025 09:11:11 -0700

apparmor (4.1.1-0ubuntu5) questing; urgency=medium

  * d/apparmor.maintscript: remove ssh-keygen profile

 -- Nick Rosbrook <enr0n@ubuntu.com>  Tue, 15 Jul 2025 15:37:33 -0400

apparmor (4.1.1-0ubuntu4) questing; urgency=medium

  * d/p/ubuntu/ssh_keygen_mr_1519.patch: revert ssh-keygen profile
    This is breaking basic ssh-keygen functionality, and started quietly
    breaking various autopkgtests that rely on ssh-keygen (LP: #2116288)
  * d/control: Build-Depends: net-tools, for test_unconfined

 -- Nick Rosbrook <enr0n@ubuntu.com>  Thu, 10 Jul 2025 17:17:44 -0400

apparmor (4.1.1-0ubuntu3) questing; urgency=medium

  * d/p/u/lsblk_mr_1437.patch: merge other lsblk patches into this one:
    - d/p/u/lsblk_network_disk_fixup.patch
    - d/p/u/lsblk-s390-fixes.patch
    - d/p/u/lsblk_vbd.patch
  * Add a patch to fix lsblk and --tree (LP: #2110212):
    - d/p/u/lsblk_sudo_and_tree.patch
  * d/p/u/openvpn_mr_1263.patch: merge other openvpn patches into this one:
    - d/p/u/openvpn-systemd-notify.patch
    - d/p/u/openvpn-networkmanager-imports.patch
    - d/p/u/openvpn-permissive-paths.patch
    - d/p/u/openvpn_dnsfix.patch
  * d/p/u/iotop_c_mr_1520.patch: merge other iotop_c patch into this one:
    - d/p/u/profiles-give-iotop-c-additional-accesses.patch
  * d/p/u/fusermount3_mr_1514.patch: squash other fusermount3 patches:
    - d/p/u/fusermount3_profile_fixup.patch
    - d/p/u/fusermount3-flatpak-fixup.patch
    - d/p/u/fusermount3-mount-nested-subdirs-run-user.patch
    - d/p/u/fusermount3-Include-full-nameservice-rules-for-SSSD-users.patch
    - d/p/u/fusermount3_cvmfs.patch
    - d/p/u/fusermount3_allow_more_flags.patch
    - d/p/u/profiles-add-ix-permissions-for-mount-and-umount-on-.patch
    - d/p/u/profiles-add-mount-permissions-to-fusermount3-needed.patch
  * d/p/u/mbsync_mr_1372.patch: update patch for current upstream MR
  * Add patch to add new profiles that are not targeted for inclusion in
    a future upstream AppArmor 5.0:
    - d/p/u/curl_mr_1560.patch
    - d/p/u/ssh_keygen_mr_1519.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Fri, 13 Jun 2025 11:34:04 -0700

apparmor (4.1.1-0ubuntu2) questing; urgency=medium

  * Add patches to fix fusermount3 profile (LP: #2111845):
    - d/p/u/profiles-add-ix-permissions-for-mount-and-umount-on-.patch
    - d/p/u/profiles-add-mount-permissions-to-fusermount3-needed.patch

 -- Georgia Garcia <georgia.garcia@canonical.com>  Fri, 13 Jun 2025 08:39:45 -0300

apparmor (4.1.1-0ubuntu1) questing; urgency=medium

  * New upstream release.
  * Updated patches to apply to the new release:
    - d/p/u/tinyproxy_mr_1477.patch
    - d/p/u/0001-utils-read_profiles-robust-against-unparseable.patch
    - d/p/u/0002-utils-test-minitools-resiliency-against-unparsed.patch
    - d/p/u/attach_disconnected_ipc.patch
  * Refreshed patches to apply to the new release:
    - d/p/u/libapparmor-swig-perl-typemaps.patch
    - d/p/u/profiles-grant-access-to-systemd-resolved.patch
    - d/p/u/parser-fix-pam_apparmor-regression-test-failures.patch
  * Dropped patches that were applied upstream:
    - d/p/u/sbuild_mr_1555.patch
    - d/p/u/add-qt6-abstractions.patch
    - d/p/u/utils-fix-ignore-hotkey-conflict.patch
    - d/p/u/libapparmor-bump-patch-version-for-features-prefix.patch
    - d/p/u/utils-add-unprivileged_userns-to-aa-notify-list.patch
    - d/p/aa-notify-dont-merge-configs-with-confdir.patch
    - d/p/u/plasmashell-QtWebEngineProcess-new-path.patch
    - d/p/u/unprivileged_userns_rootdir.patch
    - d/p/u/parser-fix-handling-of-norelatime-mount-rule-flag.patch
  * Dropped patches that were superseded upstream:
    - d/p/u/utils-fix-mount-handling-hyphens.patch
    - d/p/u/utils-fix-profile-header-generation.patch
    - d/p/u/libapparmor-features-match-prefixes.patch
    - d/p/u/0003-utils-remove-the-skip_-_profiles-testing-bypass.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 09 Jun 2025 16:06:43 -0700

apparmor (4.1.0~beta5-0ubuntu16) questing; urgency=medium

  * d/p/u/fusermount3_allow_more_flags.patch: allow noexec flag on mount
    (LP: #2111807)
  * Add patch to give lsblk access to information about Xen vbd devices
    (LP: #2111604)
    - d/p/u/lsblk_vbd.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Tue, 27 May 2025 15:47:45 -0400

apparmor (4.1.0~beta5-0ubuntu15) questing; urgency=medium

  * Add patch to allow unprivileged_userns access to root dir
    (https://gitlab.com/apparmor/apparmor/-/issues/505):
    - d/p/u/unprivileged_userns_rootdir.patch
  * Add patch to fix lsblk accesses on IBM System Z systems (LP: #2107402)
    and execution from a confined context (LP: #2107455):
    - d/p/u/lsblk-s390-fixes.patch
  * Add patch to fix execution of various commands from confined contexts
    (https://gitlab.com/apparmor/apparmor/-/merge_requests/1637,
    backport of the profile fixes and logprof test fix):
    - d/p/u/profiles_ensure_access_to_attach_path.patch
  * Add patch to include new QtWebEngineProcess execution path in
    plasmashell profile (LP: #2107723):
    - d/p/u/plasmashell-QtWebEngineProcess-new-path.patch
  * Add patch to allow /cvmfs fusermounts
    (https://gitlab.com/apparmor/apparmor/-/merge_requests/1587):
    - d/p/u/fusermount3_cvmfs.patch
  * Add patch to grant OpenVPN DNS accesses (LP: #2107596, LP: #2109029)
    - d/p/u/openvpn_dnsfix.patch
  * Add patch to expand allowed fusermount3 flags for fuse_overlayfs
    (https://gitlab.com/apparmor/apparmor/-/merge_requests/1673)
    - d/p/u/fusermount3_allow_more_flags.patch
  * Add patch to fix permission denials for iotop-c (LP: #2107727):
    - d/p/u/profiles-give-iotop-c-additional-accesses.patch
  * Add patch to fix parser handling of norelatime mount flag
    (https://gitlab.com/apparmor/apparmor/-/merge_requests/1679):
    - d/p/u/parser-fix-handling-of-norelatime-mount-rule-flag.patch
  * Add patch to fix incorrect mount rule documentation in the apparmor.d
    man page (https://gitlab.com/apparmor/apparmor/-/merge_requests/1674):
    - d/p/u/fix-incorrect-mount-flag-apparmor.d-docs.patch
    - d/p/u/regression-verify-documented-mount-flag-behavior.patch
  * d/p/u/remmina_mr_1348.patch, d/p/u/remmina-dbus-describeall.patch:
    move the remmina profile to profiles/apparmor/profiles/extras to
    disable it by default (LP: #2102033)
  * debian/apparmor.install: remove the remmina profile entry
  * debian/apparmor-profiles.install: add an entry for the remmina profile
  * debian/apparmor.maintscript: remove the remmina profile upon upgrade

 -- Ryan Lee <ryan.lee@canonical.com>  Wed, 07 May 2025 11:29:02 -0700

apparmor (4.1.0~beta5-0ubuntu14) plucky; urgency=medium

  * Add patch to fix fusermount3 denials for SSSD users (LP: #2106311):
    - d/p/u/fusermount3-Include-full-nameservice-rules-for-SSSD-users.patch

 -- Alessandro Astone <alessandro.astone@canonical.com>  Thu, 10 Apr 2025 14:44:42 +0200

apparmor (4.1.0~beta5-0ubuntu13) plucky; urgency=medium

  * Rename and edit patch to fix lsblk denials on networked file systems
    (LP: #2092232):
    - d/p/u/lsblk_hyper_v_fixup.patch ->
      d/p/u/lsblk_network_disk_fixup.patch
  * Add patch to fix kernel feature search with substrings (LP: #2105986):
    - d/p/u/libapparmor-feature-match-prefixes.patch
    - d/p/u/libapparmor-bump-patch-version-for-features-prefix.patch
  * Add patch to align aa-notify userns_special_profiles default to config
    default (LP: #2106174):
    - d/p/u/utils-add-unprivileged_userns-to-aa-notify-list.patch
  * Add patches for aa-notify default config to avoid suggesting
    capabilities addition for unprivileged_userns profile (LP: #2106177):
    - d/p/u/aa-notify-dont-merge-configs-with-confdir.patch
    - d/p/u/aa-notify-userns-filtering.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Wed, 02 Apr 2025 11:01:53 -0700

apparmor (4.1.0~beta5-0ubuntu12) plucky; urgency=medium

  [ Ryan Lee ]
  * Add patch to fix lsblk denials on Hyper-V systems (LP: #2103524):
    - d/p/u/lsblk_hyper_v_fixup.patch
  * Add patch to allow fusermount3 to mount nested subdirectores of
    @{run}/user/@{uid} (LP: #2103889):
    - d/p/u/fusermount3-mount-nested-subdirs-run-user.patch
  * Add patch to fix utils hotkey conflict with ignore (LP: #2104194):
    - d/p/u/utils-fix-ignore-hotkey-conflict.patch
  * Add patch to fix aa-enforce not handling child profiles (LP: #2104193):
    - d/p/u/utils-fix-profile-header-patch-generation.patch
  [ Tim Andersson ]
  * Allow remmina to make DescribeAll calls through the DBus.
    (LP: #2102033):
    - d/p/u/remmina-dbus-describeall.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 24 Mar 2025 10:14:46 -0700

apparmor (4.1.0~beta5-0ubuntu11) plucky; urgency=medium

  * Add qt6 abstractions to fix KDE applicationis crashes.
    - d/p/ubuntu/add-qt6-abstractions.patch

 -- Scarlett Moore <sgmoore@debian.org>  Thu, 20 Mar 2025 05:48:26 -0700

apparmor (4.1.0~beta5-0ubuntu10) plucky; urgency=medium

  * Remove set -x from apparmor.postinst (LP: #2103663)

 -- Alex Murray <alex.murray@canonical.com>  Thu, 20 Mar 2025 11:58:44 +1030

apparmor (4.1.0~beta5-0ubuntu9) plucky; urgency=medium

  * Remove the patch enabling the unshare-userns-restrict profile by
    default (LP: #2102081):
    - d/p/u/Move-the-unshare-userns-restrict-profile-out-of-extras.patch
  * Add patch allowing openvpn --genkey and homedir key locations
    (LP: #2098930):
    - d/p/u/openvpn-permissive-paths.patch
  * Add patch for parser attach_disconnected.ipc mediation (LP: #2102237):
    - d/p/u/attach_disconnected_ipc.patch
  * debian/apparmor.install: remove entry for unshare-userns-restrict
  * debian/apparmor-profiles.install: add entry for
    unshare-userns-restrict
  * debian/apparmor.maintscript: remove unshare-userns-restrict profile
    if it was previously installed
  * Add a patch to support "yes"/"no" literal values for the
    unconfined_restrictions/userns sysctl (LP: #2102680):
    - d/p/u/userns-runtime-disable-fix-for-6_14.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 13 Mar 2025 09:49:44 -0700

apparmor (4.1.0~beta5-0ubuntu8) plucky; urgency=medium

  * Add a patch to allow OpenVPN access to the systemd notify socket
    (LP: #2101796):
    - d/p/u/openvpn-systemd-notify.patch
  * Add a patch to allow OpenVPN to read NetworkManager imported certs
    (LP: #2101909):
    - d/p/u/openvpn-networkmanager-imports.patch
  * Add a patch to allow utils to parse the fusermount profile
    (LP: #2101869):
    - d/p/u/utils-fix-mount-handling-hyphens.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Mon, 10 Mar 2025 09:43:48 -0700

apparmor (4.1.0~beta5-0ubuntu7) plucky; urgency=medium

  * Add patch to add os-prober and linux-boot-prober profiles
    (LP: #2099811):
    - d/p/u/os_prober_mr_1569.patch
  * debian/apparmor.install: add entries for the os-prober and
    linux-boot-prober profiles

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 06 Mar 2025 10:44:41 -0800

apparmor (4.1.0~beta5-0ubuntu6) plucky; urgency=medium

  * Add patch for lsusb profile to access non-PCI USB info (LP: #2099990):
    - d/p/u/lsusb_profile_fixup.patch
  * Add patches to enable Python utils to skip profiles they can't parse
    (LP: #2100744):
    - d/p/u/0001-utils-read_profiles-robust-against-unparseable.patch
    - d/p/u/0002-utils-test-minitools-resiliency-against-unparsed.patch
    - d/p/u/0003-utils-remove-the-skip_-_profiles-testing-bypass.patch
  * Add patch to fix fusermount3 profile breaking flatpaks (LP: #2100295)
    - d/p/u/fusermount3-flatpak-fixup.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 27 Feb 2025 14:45:18 -0800

apparmor (4.1.0~beta5-0ubuntu5) plucky; urgency=medium

  * Add patch to fix fusermount3 profile breaking AppImages (LP: #2098993)
    - d/p/u/fusermount3_profile_fixup.patch
  * debian/apparmor.maintscript: remove tar and wpa_supplicant profiles
    if they were previously installed via an upgrade

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 20 Feb 2025 09:18:01 -0800

apparmor (4.1.0~beta5-0ubuntu4) plucky; urgency=medium

  * Add patch to fix sbuild unshare breakage caused by the new
    unshare-userns-restrict profile (LP: #2098906)
    - d/p/u/sbuild_mr_1555.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Wed, 19 Feb 2025 16:24:56 -0800

apparmor (4.1.0~beta5-0ubuntu3) plucky; urgency=medium

  * Add patch to address AppArmor denial logs reported in LP: #2098838:
    - d/p/u/wpa_supplicant_profile_fixup.patch
  * debian/apparmor.install: remove wpa_supplicant profile from default
    install
  * debian/apparmor-profiles.install: place wpa_supplicant profile in
    extra-profiles

 -- Ryan Lee <ryan.lee@canonical.com>  Wed, 19 Feb 2025 13:56:15 -0800

apparmor (4.1.0~beta5-0ubuntu2) plucky; urgency=medium

  * Add patch to add capability fowner permission to the tar profile to
    fix tar and snapd autopkgtest failures
    - d/p/u/tar_cap_fowner_fix_mr_1553.patch
  * debian/apparmor.install: remove tar profile from default install
  * debian/apparmor-profiles.install: place tar profile in extra-profiles

 -- Alex Murray <alex.murray@canonical.com>  Wed, 19 Feb 2025 12:08:03 +1030

apparmor (4.1.0~beta5-0ubuntu1) plucky; urgency=medium

  * New upstream release.
  * Dropped patches that were applied upstream:
    - d/p/u/profiles-fix-non-user-namespace-bypass-in-unshare.patch
    - d/p/u/libapparmor-swig-various-fixes-for-32bit-and-older.patch
    - d/p/u/aa-notify-ttkthemes-fallback-mr1324-partial.patch
    - d/p/u/aa-notify-fix-packaging-polkit.patch
    - d/p/u/utils-allow-install-locations-to-be-overridden-in-Make.patch
  * Add patch to fix Perl SWIG typemaps to complement upstream SWIG updates:
    - d/p/u/libapparmor-swig-perl-typemaps.patch
  * debian/apparmor.install: add entry for new upstream tunables/system
    tunable
  * debian/apparmor-notify.install: update location of polkit policy
    file to match the new upstream location

 -- Ryan Lee <ryan.lee@canonical.com>  Tue, 18 Feb 2025 09:17:44 -0800

apparmor (4.1.0~beta4-0ubuntu3) plucky; urgency=medium

  * Add patch to fix build path leaking into generated polkit file:
    - d/p/u/aa-notify-fix-packaging-polkit.patch
  * Add patch to enable environment variable overrides in utils Makefile:
    - d/p/u/utils-allow-install-locations-to-be-overridden-in-Make.patch

 -- Ryan Lee <ryan.lee@canonical.com>  Thu, 13 Feb 2025 14:30:46 -0800

apparmor (4.1.0~beta4-0ubuntu2) plucky; urgency=medium

  * Add patch to fix libapparmor SWIG build on 32-bit systems:
    - d/p/u/libapparmor-swig-various-fixes-for-32-bit-and-older.patch
  * Add patch for aa-notify GUI fallback when python3-ttkthemes is
    unavailable:
    - d/p/u/aa-notify-ttkthemes-fallback-mr1324-partial.patch
  * Add patch with another new AppArmor profile for testing:
    - d/p/u/mosquitto_mr_1506.patch
  * debian/apparmor.install: add entry for the mosquitto profile
  * debian/control: remove python3-ttkthemes from Build-Depends to fix
    i386 build now that fallback is available

 -- Ryan Lee <ryan.lee@canonical.com>  Wed, 12 Feb 2025 15:30:49 -0800

apparmor (4.1.0~beta4-0ubuntu1) plucky; urgency=medium

  * New upstream release.
  * Auto-refreshed patches via quilt refresh:
    - d/p/u/profiles-grant-access-to-systemd-resolved.patch
    - d/p/u/samba-systemd-interaction.patch
    - d/p/u/parser-fix-pam_apparmor-regression-test-failures.patch
  * Drop patches that were applied upstream:
    - d/p/u/utils-change-os.mkdir-to-self.mkpath-to-create-inter.patch
    - d/p/u/parser-fix-rule-priority-destroying-rule-permissions.patch
    - d/p/u/libapparmor-make-af_protos.h-consistent-in-different.patch
    - d/p/u/fix-abi-break-record-for-aa-log-record.patch
    - d/p/u/handle-missing-cgitb.patch
  * Drop patches that were superseded upstream:
    - d/p/u/parser-fix-integer-overflow-bug-in-rule-priority-com.patch
    - d/p/u/parser-revert-removal-of-second-minimization-pass.patch
    - d/p/u/parser-update-tsts-for-explicit-deny-and-filtering-c.patch
  * Add patches containing new AppArmor profiles for more testing:
    - d/p/u/znc_mr_1376.patch
    - d/p/u/tfntp_mr_1363.patch
    - d/p/u/socat_mr_1319.patch
    - d/p/u/rygel_mr_1311.patch
    - d/p/u/remmina_mr_1348.patch
    - d/p/u/lsusb_mr_1433.patch
    - d/p/u/lsblk_mr_1437.patch
    - d/p/u/mbsync_mr_1372.patch
    - d/p/u/openvpn_mr_1263.patch
    - d/p/u/tshark_mr_1384.patch
    - d/p/u/wireguard_mr_1323.patch
    - d/p/u/irssi_mr_1332.patch
    - d/p/u/netcat-openbsd_mr_1327.patch
    - d/p/u/tar_mr_1453.patch
    - d/p/u/alsamixer_mr_1517.patch
    - d/p/u/tinyproxy_mr_1477.patch
    - d/p/u/frr_mr_1380.patch
    - d/p/u/iotop_c_mr_1520.patch
    - d/p/u/wpa_supplicant_mr_1385.patch
    - d/p/u/fusermount3_mr_1514.patch
    - d/p/u/dnstracer_mr_1366.patch
  * Add a patch to enable the *-userns-restrict profiles by default:
    - d/p/u/Move-the-bwrap-userns-restrict-profile-out-of-extras.patch
    - d/p/u/Move-the-unshare-userns-restrict-profile-out-of-extras.patch
  * Add a patch that deletes the busybox and nautilus profiles:
    - d/p/u/delete-the-busybox-and-nautilus-profiles.patch
  * debian/apparmor.dirs: remove /lib/apparmor as it would already be
    created by the file installation process
  * debian/apparmor.install:
    - Install some files into /usr directory instead of under root
      directory (as per the /usr merge):
      - lib/apparmor/profile-load
      - sbin/apparmor_parser
      - parser/apparmor.systemd
      - lib/apparmor/rc.apparmor/functions
    - Install newly added profiles from profile patches above, with
      the exception of the socat profile (d/p/u/socat_mr_1319.patch)
    - Add installation of the *-userns-restrict profiles to install
      them to /etc/apparmor.d/
    - Remove entries for the busybox and nautilus profiles
  * debian/apparmor.manpages: add upstream aa-load.8 man page
  * debian/apparmor-profiles.install:
    - Add entry for new upstream postfix-tlsproxy profile
    - Add entry for the socat profile (d/p/u/socat_mr_1319.patch)
    - Remove entries for *-userns-restrict profiles (moved to debian/
      apparmor.install)
  * debian/control:
    - Add utils Build-Depends under a !nocheck condition for tests:
      - flake8
      - python3-gi
      - python3-notify2
      - python3-psutil
      - python3-tk
      - python3-ttkthemes
  * debian/rules:
    - override_dh_auto_build
      - No longer create libraries/libapparmor/testsuite/test_multi/
        testcase_mqueue_0[1-8].err empty files, as the patch they were
        supposed to accompany was applied upstream
    - override_dh_auto_test
      - Test libapparmor in override_dh-auto-test before the parser and
        binutils
      - Add step that runs tests for utils
    - override_dh_install-arch
      - Fixup chmod call for lib/apparmor/apparmor.systemd for /usr
        install location
  * debian/libpam-apparmor.install:
    - Install lib/security/pam_apparmor.so into /usr directory (as per
      the /usr merge)
  * debian/usr/lib/sysctl.d/10-apparmor.conf: Set sysctl
    kernel.apparmor_restrict_unprivileged_unconfined=1

 -- Ryan Lee <ryan.lee@canonical.com>  Tue, 11 Feb 2025 17:12:16 -0800

apparmor (4.1.0~beta1-0ubuntu5) plucky; urgency=medium

  * d/p/u/handle-missing-cgitb.patch: handle the missing cgitb module, no
    longer shipped with python 3.13 (LP: #2095597)

 -- Andreas Hasenack <andreas@canonical.com>  Tue, 28 Jan 2025 14:21:29 -0300

apparmor (4.1.0~beta1-0ubuntu4) plucky; urgency=medium

  * SRU: #2083480: No-change rebuild to add support for Python 3.13.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 13 Nov 2024 09:56:58 +0100

apparmor (4.1.0~beta1-0ubuntu3) oracular; urgency=medium

  * Add patch from upstream to fix unintentional ABI break (LP :#2083435)
  - d/p/u/fix-abi-break-record-for-aa-log-record.patch

 -- Alex Murray <alex.murray@canonical.com>  Wed, 02 Oct 2024 08:54:43 +0930

apparmor (4.1.0~beta1-0ubuntu2) oracular; urgency=medium

  [Georgia Garcia]
  * Add patch to fix FTBFS on armhf
    - d/p/u/libapparmor-make-af_protos.h-consistent-in-different.patch

 -- Alex Murray <alex.murray@canonical.com>  Tue, 20 Aug 2024 08:54:20 +0930

apparmor (4.1.0~beta1-0ubuntu1) oracular; urgency=medium

  [John Johansen]
  * New upstream release.
  * Refresh
    - d/p/d/libapparmor-layout-deb.patch
    - d/p/d/etc-writable.patch
  * Drop patches which have now been applied upstream
    - d/p/u/parser-add-support-for-prompting.patch
    - d/p/u/profiles-add-unconfined-balena-etcher-profile.patch
    - d/p/u/mountrule-relaxing-constraints-on-fstype.patch
    - d/p/u/tests-refactor-logic-that-makes-mntpoint-private-for.patch
    - d/p/u/tests-remount-tmpdir-as-private-instead-of.patch
    - d/p/u/tests-enable-swap-test-when-tmp-is-tmpfs.patch
    - d/p/u/test-detect-if-setuid-environ-test-in-running-under-.patch
  * Add patch to fix installation of com.ubuntu.pkexec.aa-notify.policy
    - d/p/u/parser-fix-rule-priority-destroying-rule-permissions.patch
    - d/p/u/parser-fix-integer-overflow-bug-in-rule-priority-com.patch
    - d/p/u/parser-revert-removal-of-second-minimization-pass.patch
    - d/p/u/parser-update-tsts-for-explicit-deny-and-filtering-c.patch
  [Georgia Garcia]
  * Add patch to fix installation of com.ubuntu.pkexec.aa-notify.policy
    - d/p/u/utils-change-os.mkdir-to-self.mkpath-to-create-inter.patch
    - d/p/u/ubuntu/parser-fix-pam_apparmor-regression-test-failures.patch
  * d/apparmor.install
    - fix wike installation path
    - install new profile
      - Xorg
      - chromium
  * d/control:
    - add depends to apparmor-notify:
      - python3-tk
      - python3-ttkthemes
      - python3-gi
  * d/apparmor-notify.install
    - etc/apparmor/default_unconfined.template
    - usr/share/polkit-1/actions/com.ubuntu.pkexec.aa-notify.policy
  * d/libapparmor1.symbols
    - add aa_split_overlay_str

 -- John Johansen <john.johansen@canonical.com>  Thu, 15 Aug 2024 06:41:27 -0700

apparmor (4.0.1really4.0.1-0ubuntu2) oracular; urgency=medium

  * Drop patch that enables bwrap profile
  - d/p/u/enable-bwrap-profile.patch (LP: #2072811)
  * d/apparmor.install
    - remove bwrap-userns-restrict
  * d/apparmor.maintscript: rm_conffile of bwrap-userns-restrict in
    /etc/apparmor.d/ to properly revert conffiles introduced in
    4.0.1-0ubuntu1
  * d/apparmor-profiles.install
    - install new profile
      - bwrap-userns-restrict
  * Drop patch that moves wike profile from apparmor to apparmor.d so it's
  done by d/apparmor.install. The patch caused a warning from dpkg-source
  because it didn't contain a diff
  * d/apparmor.install
    - install new profile
      - wike - changed installation from apparmor to apparmor.d
  * Add patches that fix regression tests when they run on a mounted /tmp
    in tmpfs
    - d/p/u/tests-refactor-logic-that-makes-mntpoint-private-for.patch
    - d/p/u/tests-remount-tmpdir-as-private-instead-of.patch
    - d/p/u/tests-enable-swap-test-when-tmp-is-tmpfs.patch
    - d/p/u/test-detect-if-setuid-environ-test-in-running-under-.patch

 -- Georgia Garcia <georgia.garcia@canonical.com>  Tue, 16 Jul 2024 14:33:39 -0300

apparmor (4.0.1-0ubuntu1) oracular; urgency=medium

  [Georgia Garcia]
  * New upstream release.
  * Refresh
    - d/p/u/parser-add-support-for-prompting.patch
      - Add condition in policydb serialization to only encode xtable if
      kernel_supports_permstable32
  * Add patch to fix wike profile location (LP: #2046844)
    - d/p/u/profiles-fix-wike-profile-location-to-apparmor.d.patch
  * Add patch to add balena-etcher profile (LP: #2046844)
    - d/p/u/profiles-add-unconfined-balena-etcher-profile.patch
  * Fix d/p/u/userns-runtime-disable.patch to work when
    kernel.apparmor_restrict_unprivileged_userns does not exist by adding
    -e to sysctl.
  * d/apparmor.install
    - install new profiles
      - wike
      - foliate
      - balena-etcher
      - transmission

  [John Johansen]
  * Refresh
    - d/p/u/samba-systemd-interaction.patch
  * Drop patches which have now been applied updatea
    - d/p/u/parser-fix-issues-appointed-by-coverity.patch
    - d/p/u/profiles-add-unconfined-profile-for-tuxedo-control-c.patch
  * Add patch to enable bwrap profile
    - d/p/u/enable-bwrap-profile.patch
      (LP: #2046844)
  * d/apparmor.install
    - install new profile
      - bwrap-userns-restrict
  * d/apparmor-profiles.install
    - install new profile
      - unshare-userns-restrict

  [ Alex Murray ]
  * Add upstream patch to relax mount rules to fix use of virtiofs and
    other file-system types
    - d/p/u/mountrule-relaxing-constraints-on-fstype.patch
  * Remove patches which got dropped from quilt series earlier
    - d/p/u/parser-support-uin128_t-key-as-a-pair-of-uint64_t-nu.patch
    - d/p/u/Minor-improvements-for-MountRule.patch
  * d/control: Remove obsolete lsb-base Depends and swap pkg-config to
    pkgconf for Build-Depends

 -- Alex Murray <alex.murray@canonical.com>  Wed, 08 May 2024 11:37:47 +0200

apparmor (4.0.0-beta3-0ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 07:27:03 +0000

apparmor (4.0.0-beta3-0ubuntu2) noble; urgency=medium

  * d/apparmor.install
    - install new profiles
      - geary
      - goldendict
      - kchmviewer
      - loupe
      - notepadqq
      - pageedit
      - privacybrowser
      - qmapshack
      - qutebrowser
      - rssguard
      - scide
      - tuxedo-control-center
      - unix-chkpwd

 -- John Johansen <johnjohansen@canonical.com>  Mon, 18 Mar 2024 18:34:14 -0700

apparmor (4.0.0-beta3-0ubuntu1) noble; urgency=medium

  * New upstream release.
    (LP: #2058329, LP: #2056747, LP: #2056739, LP: #2046844)
  * Refresh patches
    - d/p/u/samba-systemd-interaction.patch
    - d/p/u/parser-add-support-for-prompting.patch
  * Drop patches which have now been applied upstream
    - ubuntu/parser-support-uin128_t-key-as-a-pair-of-uint64_t-nu.patch
    - ubuntu/Minor-improvements-for-MountRule.patch
  * Add patches from upstream that are post Beta3 and will be in Beta4
    - d/p/u/parser-fix-issues-appointed-by-coverity.patch
    - d/p/u/profiles-add-unconfined-profile-for-tuxedo-control-c.patch
      (LP: #2046844)
 -- John Johansen <johnjohansen@canonical.com>  Mon, 18 Mar 2024 16:48:32 -0700

apparmor (4.0.0~beta2-0ubuntu3) noble; urgency=medium

  * Add fix for failing mount rule tests
    - d/p/u/Minor-improvements-for-MountRule.patch

 -- John Johansen <johnjohansen@canonical.com>  Thu, 07 Mar 2024 11:32:22 -0800

apparmor (4.0.0~beta2-0ubuntu2) noble; urgency=medium

  * No-change update .changes file to include everything from 4.0.0~alpha4-0ubuntu1

 -- John Johansen <johnjohansen@canonical.com>  Wed, 06 Mar 2024 22:08:28 -0800

apparmor (4.0.0~beta2-0ubuntu1) noble; urgency=medium

  * New upstream release.
  * Refresh patches
    - d/p/u/parser-add-support-for-prompting.patch
 -- John Johansen <johnjohansen@canonical.com>  Wed, 06 Mar 2024 18:29:50 -0800

apparmor (4.0.0~beta1-0ubuntu4) noble; urgency=medium

  * Add fix for 32 bit architectures
    - d/p/u/parser-support-uin128_t-key-as-a-pair-of-uint64_t-nu.patch
 -- John Johansen <johnjohansen@canonical.com>  Thu, 29 Feb 2024 17:32:43 -0800

apparmor (4.0.0~beta1-0ubuntu3) noble; urgency=medium

  * Update uint128_t define
    - d/p/u/parser-add-support-for-prompting.patch
 -- John Johansen <johnjohansen@canonical.com>  Thu, 29 Feb 2024 16:42:15 -0800

apparmor (4.0.0~beta1-0ubuntu2) noble; urgency=medium

  * Add feature support patches for prompt
    - d/p/u/parser-add-support-for-prompting.patch
 -- John Johansen <johnjohansen@canonical.com>  Thu, 29 Feb 2024 16:12:32 -0800

apparmor (4.0.0~beta1-0ubuntu1) noble; urgency=medium

  * New upstream release.
  * Drop patches which have now been applied upstream
    - d/p/u/add-keybase-unconfined-profile.patch
    - d/p/u/add-more-unconfined-profiles.patch
    - d/p/u/tests-fix-usr-merge-failures-on-exec-and-regex-tests.patch
    - d/p/u/tests-handle-unprivileged_userns-transition-in-usern.patch
  * Refresh patches
    - d/p/u/samba-systemd-interaction.patch
  * d/apparmor.install
    - install new profiles
      - nautilus
      - element-desktop
  * d/control: add build-dependency on autoconf-archive

 -- Georgia Garcia <georgia.garcia@canonical.com>  Thu, 29 Feb 2024 19:33:32 -0300

apparmor (4.0.0~alpha4-0ubuntu1) noble; urgency=medium

  [Georgia Garcia]
  * New upstream release.
  * Add unconfined profiles to support the use unprivileged user namespace
    (LP: #2052297, LP: #2046844)
    - d/p/u/add-keybase-unconfined-profile.patch
    - d/p/u/add-more-unconfined-profiles.patch
  * Fix regression tests failures on regex.sh, exec.sh and userns.sh
    - d/p/u/tests-fix-usr-merge-failures-on-exec-and-regex-tests.patch
    - d/p/u/tests-handle-unprivileged_userns-transition-in-usern.patch
  * Drop patches which have now been applied upstream
    - d/p/u/userns-unconfined-profiles.patch
    - d/p/u/tests-fix-userns-setns-opening-pipe-order.patch
    - d/p/u/tests-replace-individual-socket-permissions.patch
    - d/p/u/tests-fix-test-specifying-path-on-attach-disconnected.patch
    - d/p/u/binutils-aa_status.c-quiet-verbose-outputs-when-json.patch
    - d/p/u/oot-unconfined-profiles.patch
  * Refresh patches
    - d/p/d/etc-writable.patch
    - d/p/u/profiles-grant-access-to-systemd-resolved.patch
    - d/p/u/userns-runtime-disable.patch
  * d/apparmor.install
    - install new profiles
      - plasmashell
      - surfshark
      - unprivileged_userns
      - keybase
      - devhelp
      - epiphany
      - evolution
      - opam
    - renamed profiles
      - ch-checkns
      - ch-run
      - crun
      - flatpak
      - linux-sandbox
      - busybox
      - buildah
      - cam
      - ipa_verify
      - lc-compliance
      - libcamerify
      - qcam
      - podman
      - lxc-attach
      - lxc-create
      - lxc-destroy
      - lxc-execute
      - lxc-stop
      - lxc-unshare
      - lxc-usernsexec
      - mmdebstrap
      - vpnns
      - QtWebEngineProcess
      - systemd-coredump
      - rootlesskit
      - rpm
      - runc
      - virtiofsd
      - sbuild
      - sbuild-abort
      - sbuild-adduser
      - sbuild-apt
      - sbuild-checkpackages
      - sbuild-clean
      - sbuild-createchroot
      - sbuild-destroychroot
      - sbuild-distupgrade
      - sbuild-hold
      - sbuild-shell
      - sbuild-unhold
      - sbuild-update
      - sbuild-upgrade
      - slirp4netns
      - stress-ng
      - thunderbird
      - toybox
      - trinity
      - tup
      - userbindmount
      - uwsgi-core
      - vdens
      - chrome
      - msedge
      - brave
      - vivaldi-bin
  * d/apparmor.maintscript
    - add renamed profiles so they are removed on upgrade
  * d/libapache2-mod-apparmor.install
    - remove etc/apparmor.d/local/usr.sbin.apache2, no longer needed

  [John Johansen]
  * debian/rules:
    - don't run debian/put-all-profiles-in-complain-mode.sh on install

  [Alex Murray]
  * debian/apparmor.lintian-overrides:
    - suppress false-positive warning about needing a Depends: on adduser
      for the apparmor binary package

 -- Georgia Garcia <georgia.garcia@canonical.com>  Fri, 02 Feb 2024 16:12:21 -0300

apparmor (4.0.0~alpha2-0ubuntu8) noble; urgency=medium

  * Add unconfined userns profile for systemd-coredump

 -- Nick Rosbrook <enr0n@ubuntu.com>  Wed, 10 Jan 2024 09:55:51 -0500

apparmor (4.0.0~alpha2-0ubuntu7) noble; urgency=medium

  [Alex Murray]
  * Enable user namespace restrictions by default (LP: #2046477)
    - d/p/u/userns-runtime-disable.patch: add logic to disable user
      namespace restrictions if kernel lacks support
    - debian/usr/lib/sysctl.d/10-apparmor.conf: set sysctl value to 1 and
      update comment to match
    - debian/apparmor.service: run After systemd-sysctl.service

  [John Johansen]
  * Add additional AppArmor profiles to support third-party applications
    that use unprivileged user namespace
    - add d/p/u/oot-unconfined-profiles.patch
    - add profiles to debian/apparmor.install
       - /etc/apparmor.d/1password
       - /etc/apparmor.d/Discord
       - /etc/apparmor.d/MongoDB_Compass
       - /etc/apparmor.d/code
       - /etc/apparmor.d/firefox
       - /etc/apparmor.d/github-desktop
       - /etc/apparmor.d/obsidian
       - /etc/apparmor.d/opera
       - /etc/apparmor.d/polypane
       - /etc/apparmor.d/signal-desktop
       - /etc/apparmor.d/slack
       - /etc/apparmor.d/steam

  [Alex Murray]
  * Drop duplicate profiles for usr.share.code.bin.code and
  * usr.lib.multiarch.opera.opera since they are now also in
    d/p/u/oot-unconfined-profiles.patch
    - modified d/p/u/userns-unconfined-profiles.patch to remove them
    - removed from debian/apparmor.install
    - added to debian/apparmor.maintscript to ensure they are removed on
      upgrade

 -- John Johansen <john.johansen@canonical.com>  Wed, 13 Dec 2023 20:38:45 -0800

apparmor (4.0.0~alpha2-0ubuntu6) noble; urgency=medium

  * No-change rebuild with Python 3.12 as supported version

 -- Graham Inggs <ginggs@ubuntu.com>  Tue, 31 Oct 2023 16:45:44 +0000

apparmor (4.0.0~alpha2-0ubuntu5) mantic; urgency=medium

  * Add additional AppArmor profiles to support third-party applications
    that use unprivileged user namespace restrictions (LP: #2036698)
    - Refreshed d/p/u/userns-unconfined-profiles.patch to add additional
      profiles and added to debian/apparmor.install
       - usr.share.code.bin.code
       - opt.microsoft.msedge.msedge
       - usr.lib.multiarch.opera.opera
       - opt.brave.com.brave.brave
       - opt.vivaldi.vivaldi-bin
  * Clarify comment in sysctl.d conf file that this feature is not
    enabled by default but can be overridden by the user if desired.

 -- Alex Murray <alex.murray@canonical.com>  Fri, 22 Sep 2023 16:50:22 +0930

apparmor (4.0.0~alpha2-0ubuntu4) mantic; urgency=medium

  * Remove conflicting profile for usr.bin.lxc-start (LP: #2036302)
    - d/p/u/userns-unconfined-profiles.patch: Don't ship a profile for
      usr.bin.lxc-start as this is already shipped in liblxc-common
    - debian/apparmor.install: Remove usr.bin.lxc-start profile

 -- Alex Murray <alex.murray@canonical.com>  Mon, 18 Sep 2023 10:59:37 +0930

apparmor (4.0.0~alpha2-0ubuntu3) mantic; urgency=medium

  * Add remaining AppArmor profiles to support unprivileged user
    namespace restrictions (LP: #2035315)
    - Refreshed d/p/u/userns-unconfined-profiles.patch to add remaining
      profiles and added to debian/apparmor.install
       - usr.libexec.multiarch.bazel.linux-sandbox
       - usr.bin.busybox
       - usr.bin.buildah
       - usr.bin.cam
       - usr.bin.ipa_verify
       - usr.bin.lc-compliance
       - usr.bin.libcamerify
       - usr.bin.qcam
       - usr.bin.podman
       - usr.bin.lxc-attach
       - usr.bin.lxc-create
       - usr.bin.lxc-destroy
       - usr.bin.lxc-execute
       - usr.bin.lxc-start
       - usr.bin.lxc-stop
       - usr.bin.lxc-unshare
       - usr.bin.lxc-usernsexec
       - usr.bin.mmdebstrap
       - usr.bin.vpnns
       - usr.lib.qt6.libexec.QtWebEngineProcess
       - usr.lib.multiarch.qt5.libexec.QtWebEngineProcess
       - usr.bin.rootlesskit
       - usr.bin.rpm
       - usr.sbin.runc
       - usr.libexec.virtiofsd
       - usr.bin.sbuild
       - usr.bin.sbuild-abort
       - usr.bin.sbuild-apt
       - usr.bin.sbuild-checkpackages
       - usr.bin.sbuild-clean
       - usr.bin.sbuild-createchroot
       - usr.bin.sbuild-distupgrade
       - usr.bin.sbuild-hold
       - usr.bin.sbuild-shell
       - usr.bin.sbuild-unhold
       - usr.bin.sbuild-update
       - usr.bin.sbuild-upgrade
       - usr.sbin.sbuild-adduser
       - usr.sbin.sbuild-destroychroot
       - usr.bin.slirp4netns
       - usr.bin.stress-ng
       - usr.bin.thunderbird
       - bin.toybox
       - usr.bin.trinity
       - usr.bin.tup
       - usr.bin.userbindmount
       - usr.bin.uwsgi-core
       - usr.bin.vdens
       - opt.google.chrome.chrome

 -- Alex Murray <alex.murray@canonical.com>  Thu, 14 Sep 2023 15:58:40 +0930

apparmor (4.0.0~alpha2-0ubuntu2) mantic; urgency=medium

  * Fix invalid JSON output from aa-status --json via upstream patch
    (LP: #2032994)
    - d/p/u/binutils-aa_status.c-quiet-verbose-outputs-when-json.patch

 -- Alex Murray <alex.murray@canonical.com>  Fri, 25 Aug 2023 09:48:24 +0930

apparmor (4.0.0~alpha2-0ubuntu1) mantic; urgency=medium

  [ John Johansen ]
  * New upstream release 4.0-alpha2

  [ Alex Murray ]
  * Infrastructure to enable AppArmor userns restrictions
    (LP: #2030353, LP: #2032602)
    - debian/usr/lib/sysctl.d/10-apparmor.conf: disable userns restrictions
      for now until we have a complete set of profiles for the whole
      Ubuntu archive
    - debian/apparmor.install: ship sysctl.d file in the apparmor binary
      package
    - d/p/u/userns-unconfined.patch: add some additional profiles that
      specify the userns permission with the unconfined flag for a currently
      incomplete list of applications within the Ubuntu archive that use
      unprivileged user namespaces
      - usr.bin.ch-checkns
      - usr.bin.ch-run
      - usr.bin.crun
      - usr.bin.flatpak
    - debian/put-all-profiles-in-complain-mode.sh: don't put unconfined
      profiles in complain mode
  * Add patches from upstream to fix test failures
    - d/p/u/tests-fix-userns-setns-opening-pipe-order.patch
    - d/p/u/tests-replace-individual-socket-permissions.patch
    - d/p/u/tests-fix-test-specifying-path-on-attach-disconnected.patch
  * Add new symbols

 -- Alex Murray <alex.murray@canonical.com>  Tue, 22 Aug 2023 12:30:32 +0930

apparmor (4.0.0~alpha1-0ubuntu1) mantic; urgency=medium

  * New upstream release.
  * Drop patches which have now been applied upstream
    - d/p/fix-expected-library-version.patch
    - d/p/u/enable-pinning-of-pre-AppArmor-3.x-poli.patch
    - d/p/u/regression-tests-fix-aa_policy_cache-when-using-syst.patch
    - d/p/u/add-mqueue-support.patch
    - d/p/u/add-userns-support.patch
    - d/p/u/update-snap-browsers-permissions-lp1794064.patch
    - d/p/u/add-4.0-abi.patch
  * Refresh patches
    - d/p/d/etc-writable.patch
    - d/p/u/samba-systemd-interaction.patch
  * d/apparmor.install: install aa-load
  * d/apparmor-profiles.install:
    - install new profiles
      - usr.lib.dovecot.director
      - usr.lib.dovecot.doveadm-server
      - usr.lib.dovecot.replicator
      - zgrep
      - rpcbind
      - chromium_browser
      - usr.bin.pyzorsocket
      - usr.bin.razorsocket
      - usr.sbin.clamd
      - usr.sbin.haproxy
    - rename profiles
      - firefox
      - firefox.sh

 -- Georgia Garcia <georgia.garcia@canonical.com>  Tue, 11 Jul 2023 17:20:09 -0300

apparmor (3.0.8-1ubuntu4) mantic; urgency=medium

  * Backport 4.0 ABI from upstream (LP: #2026227)
    - d/p/u/add-4.0-abi.patch

 -- Alex Murray <alex.murray@canonical.com>  Thu, 06 Jul 2023 12:14:15 +0930

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libapparmor1`.
