AppArmor kernel patches for 5.x kernels

I’m trying to get strict confinement working using the latest Debian bullseye kernel (5.8.7) under WSL 2. I’ve been looking for the additional kernel patches snapd/AppArmor wants, but the latest version I can find (in this case, shipped with AppArmor) are for kernel 4.8, which obviously won’t patch against 5.8.7.

Do we still need these with 5.x kernels? If not, have they just not been made yet?

The patches should be available for the recent Ubuntu kernels, in Ubuntu 20.04 5.4.0 is available.

you want three additional commits for 5.4 right now:

https://kernel.ubuntu.com/git/ubuntu/ubuntu-focal.git/commit/?id=1a432b8c68588a37adc17e47c14a4251638efb39

https://kernel.ubuntu.com/git/ubuntu/ubuntu-focal.git/commit/?id=21d539663dc3abafaa5fddbf69cc5093fd8c48b3

https://kernel.ubuntu.com/git/ubuntu/ubuntu-focal.git/commit/?id=cc8c477bbdf1da04c5af1c06f70d4c971d4df99c

in the order i posted them …
it might be that one or both of the first ones are not needed with 5.8 anymore … to apply them, put them in a “patches” dir in your source tree and add something like:

    override-pull: |
      snapcraftctl pull
      set -e
      echo "applying required snappy configs"
      git apply -v $SNAPCRAFT_PROJECT_DIR/patches/ubuntu-core-configs.patch

      echo "applying apparmor patches"
      git am $SNAPCRAFT_PROJECT_DIR/patches/apparmor/*
      ...

… to your snapcraft.yaml

3 Likes

Thanks muchly, that worked perfectly!

1 Like