Skip to content

[Low] Patch apparmor for CVE-2023-53154 #14011

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

[Low] Patch apparmor for CVE-2023-53154 #14011

wants to merge 2 commits into from

Conversation

durgajagadeesh
Copy link
Contributor

@durgajagadeesh durgajagadeesh commented Jun 16, 2025 •
edited
Loading

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge
Summary
Change Log
  • added: ../SPECS/apparmor/CVE-2023-53154.patch
  • Modified: ../SPECS/apparmor/apparmor.spec
Does this affect the toolchain?

NO

Associated issues
  • #xxxx
Links to CVEs
Test Methodology
  • Verified patches are applied cleanly.
image

@durgajagadeesh durgajagadeesh requested a review from a team as a code owner June 16, 2025 12:36
@durgajagadeesh durgajagadeesh marked this pull request as draft June 16, 2025 12:37
@durgajagadeesh durgajagadeesh marked this pull request as ready for review June 17, 2025 04:53
@cyberbandya007
Copy link
Contributor

Buddy Build - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=838840&view=results
Verified upstream patch and fix

@cyberbandya007
Copy link
Contributor

Buddy build failed. @durgajagadeesh , can you check the failure - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=838840&view=results

@cyberbandya007
Copy link
Contributor

Buddy build failed. @durgajagadeesh , can you check the failure - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=838840&view=results

I am waiting for updates from Jagdeesh. He has mentioned in the teams chat that he is looking into the failure.

@durgajagadeesh
Copy link
Contributor Author

durgajagadeesh commented Jul 11, 2025 •
edited
Loading

Hi @cyberbandya007,
The buddy build local results are passed at commit id b7156d8.
image

Thank you!

@cyberbandya007
Copy link
Contributor

Buddy Build - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=866885&view=results

@0xba1a
Copy link
Contributor

0xba1a commented Jul 21, 2025 •
edited
Loading

@cyberbandya007 Please update below details

  • Is the upstream patch applies cleanly or backport required. If backport required, please validate the changes and provide your justification.
  • Please make sure that the patch was cleanly applied during the build
  • Please make sure that the ptest fix patch is applied cleanly during the build

@0xba1a 0xba1a requested a review from cyberbandya007 July 21, 2025 12:08
0xba1a
0xba1a requested changes Jul 21, 2025
View reviewed changes
SPECS/apparmor/apparmor_ptest_fix.patch Outdated
@@ -0,0 +1,50 @@
From 91b1b21fe68bdbcb51552cc2dc2e930da139a123 Mon Sep 17 00:00:00 2001
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please elaborate in the commit message,

  • What is the reason of the failure
  • How this patch fixes the failure

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @0xba1a,
I have updated the commit message description according to your suggestions. Thanks!

SPECS/apparmor/apparmor.spec Outdated
@@ -355,6 +359,10 @@ make DESTDIR=%{buildroot} install
%exclude %{perl_archlib}/perllocal.pod

%changelog
* Fri Jun 13 2025 Durga Jagadeesh Palli <v-dpalli@microsoft.com> - 3.0.4-5
- Patch CVE-2023-53154
- Patch apparmor_ptest_fix.patch
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- Patch apparmor_ptest_fix.patch
- Patch apparmor_ptest_fix.patch to fix PTest failure

Copy link
Contributor Author

@durgajagadeesh durgajagadeesh Jul 25, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @0xba1a,
I have updated the patch description according to your suggestions. Thanks!

SPECS/apparmor/apparmor.spec Outdated
@@ -11,8 +11,12 @@ Source0: https://launchpad.net/apparmor/3.0/3.0.4/+download/%{name}-%{ver
Patch1: apparmor-service-start-fix.patch
Patch2: CVE-2023-50471.patch
Patch3: CVE-2024-31755.patch
Patch4: CVE-2023-53154.patch
Patch5: apparmor_ptest_fix.patch
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Name the patch after the test-case it is fixing

Copy link
Contributor Author

@durgajagadeesh durgajagadeesh Jul 25, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @0xba1a,
I’ve updated the patch name according to your suggestions. Thanks!

@cyberbandya007
Copy link
Contributor

@cyberbandya007 Please update below details

  • Is the upstream patch applies cleanly or backport required. If backport required, please validate the changes and provide your justification.
  • Please make sure that the patch was cleanly applied during the build
  • Please make sure that the ptest fix patch is applied cleanly during the build

Hi @0xba1a ,

  1. Patches applied cleanly in the build
  2. Upstream patch applied with minor line no change. No backport required.

@cyberbandya007
Copy link
Contributor

Buddy Build - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=886687&view=results

@durgajagadeesh
Copy link
Contributor Author

durgajagadeesh commented Jul 31, 2025 •
edited
Loading

Buddy Build - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=886687&view=results

Hi @cyberbandya007 and @0xba1a,
The buddy build has passed, and my patch was applied successfully.

image image image

-Thank you!

cyberbandya007
cyberbandya007 approved these changes Aug 4, 2025
View reviewed changes
Copy link
Contributor

@cyberbandya007 cyberbandya007 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I signoff the patch changes to be merged in Azure Linux and verified that it doesn't contain any security breach issues.

@Malateshk007
Copy link

@LeoMar4 / @0xba1a / @kgodara912 , gentle reminder for review and approval!

@Malateshk007
Copy link

@LeoMar4 / @0xba1a / @kgodara912 , gentle reminder for review and approval!

@LeoMar4 / @0xba1a / @kgodara912 , gentle reminder for the action!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cyberbandya007 cyberbandya007 cyberbandya007 approved these changes

@0xba1a 0xba1a Awaiting requested review from 0xba1a

Requested changes must be addressed to merge this pull request.

Assignees
No one assigned
Labels
main PR Destined for main Packaging security
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@durgajagadeesh @cyberbandya007 @0xba1a @Malateshk007