v0.5.27

Added

• AppArmor checks ptrace, as task.c of Linux: an attach and a PTRACE_TRACEME need the ptrace rules of the tracer and of the tracee. A profile without ptrace rules needs CAP_SYS_PTRACE to trace a task with another label. An exec of a traced task changes the label only if the tracer can trace the new label, as may_change_ptraced_domain of Linux. A denial gives EACCES and a record of the class ptrace (#540).
• The objects ct helper, ct timeout, ct expectation and synproxy of nf_tables, as nft_ct.c and nft_synproxy.c of Linux, with the checks of Linux and their dumps, and the ct key helper. The objects do not change the packets yet: the connections of rk have no helpers, no timeouts of their own and no expectations, and rk has no SYN proxy. The dump of a rule now gives the name of its object with a NUL byte, as Linux. Before, ct expectation set "ctexpect" came back with a wrong byte at the end of the name (#542).
• The boot test cryptenroll on x86-64 and arm64, with a TPM. cryptsetup makes a LUKS2 image in a file, systemd-cryptenroll adds a key slot that the TPM seals to PCR 7, and cryptsetup opens the key slot with the token of the TPM only. libcryptsetup uses the skcipher sockets of AF_ALG for the key slots. tools/systemd/build.sh adds cryptsetup, systemd-cryptenroll and tpm2-tools to the tree. With RK_TPM=1, the systemd boot test prints systemd-analyze has-tpm2, and with the full TPM2 support of systemd (a boot with EFI) it compares the PCRs of systemd-analyze pcrs with the PCRs of tpm2_pcrread. RK_RELEASE=1 makes the boot tests use the release kernel, which unpacks the initramfs of the systemd tree much faster on a host without KVM (#541).
• snat and dnat to a prefix of nf_tables (snat ip prefix to ip saddr map { 10.141.11.0/24 : 192.168.2.0/24 }), as NF_NAT_RANGE_NETMAP of nft_nat.c of Linux. The address keeps the bits that are not in the prefix (#542).