Security update for apparmor SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1151-1 Final 1 1 2017-05-03T07:09:00Z current 2017-05-03T07:09:00Z 2017-05-03T07:09:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apparmor This update for apparmor provides the following fixes: This security issue was fixed: - CVE-2017-6507: Preserve unknown profiles when reloading apparmor.service (bsc#1029696) These non-security issues were fixed: - Add tunables/kernelvars abstraction. (bsc#1031529) - Update flags of ntpd profile. (bsc#1022610) - Force AppArmor to start after /var/lib mounts. (bsc#1016259) - Update mlmmj profiles. (bsc#1000201) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-669,SUSE-SLE-DESKTOP-12-SP1-2017-669,SUSE-SLE-DESKTOP-12-SP2-2017-669,SUSE-SLE-RPI-12-SP2-2017-669,SUSE-SLE-SDK-12-SP1-2017-669,SUSE-SLE-SDK-12-SP2-2017-669,SUSE-SLE-SERVER-12-SP1-2017-669,SUSE-SLE-SERVER-12-SP2-2017-669 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171151-1/ Link for SUSE-SU-2017:1151-1 https://lists.suse.com/pipermail/sle-security-updates/2017-May/002841.html E-Mail link for SUSE-SU-2017:1151-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1000201 SUSE Bug 1000201 https://bugzilla.suse.com/1016259 SUSE Bug 1016259 https://bugzilla.suse.com/1022610 SUSE Bug 1022610 https://bugzilla.suse.com/1029696 SUSE Bug 1029696 https://bugzilla.suse.com/1031529 SUSE Bug 1031529 https://www.suse.com/security/cve/CVE-2017-6507/ SUSE CVE CVE-2017-6507 page SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP2 apparmor-docs-2.8.2-54.1 apparmor-parser-2.8.2-54.1 apparmor-profiles-2.8.2-54.1 apparmor-utils-2.8.2-54.1 libapparmor1-2.8.2-54.1 libapparmor1-32bit-2.8.2-54.1 pam_apparmor-2.8.2-54.1 pam_apparmor-32bit-2.8.2-54.1 perl-apparmor-2.8.2-54.1 apache2-mod_apparmor-2.8.2-54.1 libapparmor-devel-2.8.2-54.1 apparmor-docs-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 apparmor-parser-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 apparmor-profiles-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 apparmor-utils-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libapparmor1-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libapparmor1-32bit-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 pam_apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 pam_apparmor-32bit-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 perl-apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 apparmor-docs-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 apparmor-parser-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 apparmor-profiles-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 apparmor-utils-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libapparmor1-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libapparmor1-32bit-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 pam_apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 pam_apparmor-32bit-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 perl-apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 apache2-mod_apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP1 apparmor-docs-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP1 apparmor-parser-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP1 apparmor-profiles-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP1 apparmor-utils-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP1 libapparmor1-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP1 libapparmor1-32bit-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP1 pam_apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP1 pam_apparmor-32bit-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP1 perl-apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP1 apache2-mod_apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP2 apparmor-docs-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP2 apparmor-parser-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP2 apparmor-profiles-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP2 apparmor-utils-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP2 libapparmor1-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP2 libapparmor1-32bit-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP2 pam_apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP2 pam_apparmor-32bit-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP2 perl-apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server 12 SP2 apache2-mod_apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 apparmor-docs-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 apparmor-parser-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 apparmor-profiles-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 apparmor-utils-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libapparmor1-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 pam_apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 perl-apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 apache2-mod_apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 apparmor-docs-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 apparmor-parser-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 apparmor-profiles-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 apparmor-utils-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libapparmor1-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libapparmor1-32bit-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 pam_apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 pam_apparmor-32bit-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 perl-apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 apache2-mod_apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 apparmor-docs-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 apparmor-parser-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 apparmor-profiles-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 apparmor-utils-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libapparmor1-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libapparmor1-32bit-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 pam_apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 pam_apparmor-32bit-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 perl-apparmor-2.8.2-54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libapparmor-devel-2.8.2-54.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 libapparmor-devel-2.8.2-54.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due to the common logic to handle 'restart' operations removing AppArmor profiles that aren't found in the typical filesystem locations, such as /etc/apparmor.d/. Userspace projects that manage their own AppArmor profiles in atypical directories, such as what's done by LXD and Docker, are affected by this flaw in the AppArmor init script logic. CVE-2017-6507 SUSE Linux Enterprise Desktop 12 SP1:apparmor-docs-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP1:apparmor-parser-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP1:apparmor-profiles-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP1:apparmor-utils-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP1:libapparmor1-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP1:libapparmor1-32bit-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP1:pam_apparmor-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP1:pam_apparmor-32bit-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP1:perl-apparmor-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP2:apparmor-docs-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP2:apparmor-parser-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP2:apparmor-profiles-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP2:apparmor-utils-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP2:libapparmor1-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP2:libapparmor1-32bit-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP2:pam_apparmor-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP2:pam_apparmor-32bit-2.8.2-54.1 SUSE Linux Enterprise Desktop 12 SP2:perl-apparmor-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP1:apache2-mod_apparmor-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP1:apparmor-docs-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP1:apparmor-parser-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP1:apparmor-profiles-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP1:apparmor-utils-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP1:libapparmor1-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP1:libapparmor1-32bit-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP1:pam_apparmor-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP1:pam_apparmor-32bit-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP1:perl-apparmor-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP2:apache2-mod_apparmor-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP2:apparmor-docs-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP2:apparmor-parser-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP2:apparmor-profiles-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP2:apparmor-utils-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP2:libapparmor1-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP2:libapparmor1-32bit-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP2:pam_apparmor-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP2:pam_apparmor-32bit-2.8.2-54.1 SUSE Linux Enterprise Server 12 SP2:perl-apparmor-2.8.2-54.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-mod_apparmor-2.8.2-54.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apparmor-docs-2.8.2-54.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apparmor-parser-2.8.2-54.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apparmor-profiles-2.8.2-54.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apparmor-utils-2.8.2-54.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libapparmor1-2.8.2-54.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:pam_apparmor-2.8.2-54.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:perl-apparmor-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_apparmor-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:apparmor-docs-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:apparmor-parser-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:apparmor-profiles-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:apparmor-utils-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libapparmor1-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libapparmor1-32bit-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:pam_apparmor-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:pam_apparmor-32bit-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:perl-apparmor-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-mod_apparmor-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apparmor-docs-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apparmor-parser-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apparmor-profiles-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apparmor-utils-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libapparmor1-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libapparmor1-32bit-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:pam_apparmor-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:pam_apparmor-32bit-2.8.2-54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:perl-apparmor-2.8.2-54.1 SUSE Linux Enterprise Software Development Kit 12 SP1:libapparmor-devel-2.8.2-54.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libapparmor-devel-2.8.2-54.1 moderate 4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171151-1/ https://www.suse.com/security/cve/CVE-2017-6507.html CVE-2017-6507 https://bugzilla.suse.com/1029696 SUSE Bug 1029696