v0.5.21

Added

• AppArmor has child policy namespaces, as policy_ns.c of Linux. A load of a profile :NS:NAME, or of a policy with the namespace NS, makes the namespace NS if it is not there, and the load records end with ns="NS". The file profiles lists these profiles as :NS:NAME, and a remove of :NS:NAME or :NS: removes the profile or the namespace. Thus apparmor_parser loads all the profiles of Ubuntu 26.04, also :glycin:loaders and :glycin:bwrap, and aa-status lists them. A task changes to a profile of a namespace with change_profile or change_onexec of :NS://NAME, as aa-exec --namespace does. The task sees the names of its namespace without the namespace, and the attach at exec looks in its namespace. A task can also put a profile on a stack with its label, with stack NAME or changeprofile &NAME, now or at the next exec. The label of the task is then A//&B, and each profile of the stack checks the file accesses and changes at an exec. For a script, the exec hook of AppArmor now gets the script and not its interpreter, as on Linux, so the rules for the script give the profile and AT_SECURE. tools/apparmor runs the AppArmor regression tests in complain mode under QEMU, on rukernel and on a Linux reference kernel, and tools/apparmor/report.md compares the results (#540).
• /dev/tpmrm0 (253:65536), the resource manager of TPM 2.0, as tpm2-space.c and tpmrm-dev.c of Linux. Each open file has a space with up to 3 transient objects and 3 sessions. Between two commands the driver saves their contexts and flushes the objects, and before the next command it loads them again. The objects get virtual handles, and TPM2_GetCapability for the handles gives only the objects of the space. A command that the TPM does not have gets TPM_RC_COMMAND_CODE in the layer of the resource manager. The driver reads the attributes of the commands at boot. /dev/tpm0 and /dev/tpmrm0 now take a new command after a read of a part of the response, give EINVAL for a command that is shorter than its size field, and give the error of a nonblocking write in the next read, as Linux. tools/kselftest/build.sh copies the tpm2 kselftests, tools/tpm/build.sh adds python3, and the tpm boot test runs test_smoke.sh, test_space.sh and test_async.sh (#541).

Fixed

• A kill of the processes of a cgroup with memory.oom.group counts the victim again in oom_kill of memory.events, as oom_kill_memcg_member of Linux kills each process of the group, the victim too. It also counts a process that is on its way out. Before, the count was one less than on Linux, and test_memcg_oom_group_score_events of the cgroup kselftests failed (#536).
• A cgroup that ran past its cpu.max quota stays throttled until the next periods pay for the difference, as distribute_cfs_runtime of Linux unthrottles a group only when its time is above 0. Its threads wait once, up to the end of the period that pays, and do not wake in each period, because the CPU time of such a wake also counts against the quota. throttled_usec counts the throttle up to the end of that period. Before, a thread waited only to the end of one period and then ran again, so a cgroup that ran past its quota got more CPU time than its quota over many periods (#536).