Canonical Mainlines A Bunch Of Their AppArmor Changes For Linux 4.13

The Linux 4.13 kernel that's in development will pick up a big code contribution from Canonical as they have prepped a lot of their AppArmor security changes for mainlining, some of which code has been sitting in Ubuntu's kernel build for years.

Canonical security engineer John Johansen has taken to getting their AppArmor changes cleaned-up and accepted for mainline inclusion. Among their changes in this "major update" to AppArmor include bug fixes and clean-ups, symlink support for SecurityFS, and domain labeling base code that Ubuntu has been "carrying for several years."

Their domain labeling code has been cleaned-up and will allow Ubuntu/Canonical to merge more of their AppArmor code. Johansen wrote, "This finally will bring the base upstream code in line with Ubuntu and provide a base to upstream the new feature work that Ubuntu carries. This request does not contain any of the newer apparmor mediation features/controls (mount, signals, network, keys, ...) that Ubuntu is currently carrying, all of which will be RFC'd on top of this."

So hopefully it will be an exciting few rounds of kernel updates ahead if Canonical continues mainlining their AppArmor feature changes. Aside from Ubuntu, openSUSE continues to rely heavily on the AppArmor Linux security module while distributions like Arch and Gentoo continue to offer it via their package management systems.

Details on the other security changes for Linux 4.13 can be found via this pull request.