releasing package livecd-rootfs version 26.04.12

Signed-off-by: Olivier Gayot <olivier.gayot@canonical.com>

README.parameters

@@ -0,0 +1,236 @@
+Understanding the parameters used by livecd-rootfs
+==================================================
+
+livecd-rootfs is a confusing codebase. One of the confusing things is
+how information flows into and around the image build process. There
+is IMAGEFORMAT and IMAGE_TARGETS and PROJECT and many other
+variables. It is not obvious when looking at the code if a given
+variable is something passed as a parameter or something derived from
+it.
+
+All (or almost all) production use of livecd-rootfs is via
+launchpad-buildd so the set of potential parameters is limited by the
+set of environment variables launchpad-build can set in response to
+the build request.
+
+The process from build request to environment live-build is run is a
+little convoluted. The build request takes:
+
+ an archive -- where to get livecd-rootfs from
+ a distro_arch_series -- the series to get livecd-rootfs and build
+ a pocket -- pocket to get livecd-rootfs from, also influences if proposed is
+             used as a package source for the image being built
+ unique_key -- you cannot have more than one pending livefs build with the same
+               unique_key. does not affect the build at all.
+ version -- optional version string, see below. often a serial like 20250525.1
+ metadata_override -- combined with the metadata on the livefs itself to make
+                      the metadata for this build.
+
+(ref: https://launchpad.net/+apidoc/devel.html#livefs-requestBuild)
+
+These parameters are stored on the livefsbuild object (ref:
+https://git.launchpad.net/launchpad/tree/lib/lp/soyuz/model/livefsbuild.py#n372)
+and converted into a set of args passed to launchpad-build by the
+LiveFSBuildBehaviour class (ref:
+https://git.launchpad.net/launchpad/tree/lib/lp/soyuz/model/livefsbuildbehaviour.py#n99).
+
+Inside launchpad-build, these arguments are inspected by the
+LiveFilesystemBuildManager.initiate method (ref:
+https://git.launchpad.net/launchpad-buildd/tree/lpbuildd/livefs.py#n24)
+which turns them into arguments for the BuildLiveFS lpbuild
+"operation" which is what creates the environment live-build runs in
+(ref:
+https://git.launchpad.net/launchpad-buildd/tree/lpbuildd/target/build_livefs.py#n167).
+
+These variables can be set for both lb config and lb build:
+
+ PROJECT       (mandatory, comes from "project" in the metadata)
+ ARCH          (set to the abi tag of the distroarchseries being built for)
+ SUBPROJECT    (optional, comes from "subproject" in the metadata)
+ SUBARCH       (optional, comes from "subarch" in the metadata)
+ CHANNEL       (optional, comes from "subarch" in the metadata)
+ IMAGE_TARGETS (optional, comes from "image_targets" in the metadata
+                "image_targets" is a list. IMAGE_TARGETS is set to " ".join(image_targets))
+ REPO_SNAPSHOT_STAMP
+               (optional, comes from "repo_snapshot_stamp" in the metadata)
+ SNAPSHOT_SERVICE_TIMESTAMP
+               (optional, comes from "snapshot_snapshot_stamp" in the metadata)
+ COHORT_KEY
+               (optional, comes from "cohort-key" in the metadata)
+
+launchpad-buildd also contains code to set http_proxy / HTTP_PROXY /
+LB_APT_HTTP_PROXY but there does not appear to be any way to trigger
+this when requesting a build.
+
+In addition the following variables can be set for lb config only (why
+are some things set for lb config only? no idea):
+
+ SUITE         (set to the name of the distroarchseries being built for)
+ NOW           (set to value of the 'version' argument to the build request,
+                defaults to strftime("%Y%m%d-%H%M%S"))
+ IMAGEFORMAT   (optional, comes from "image_format" in the metadata)
+ PROPOSED      (set to "1" if the pocket passed to the build request is proposed)
+ EXTRA_PPAS    (optional, comes from "extra_ppas" in the metadata
+                "extra_ppas" is a list. EXTRA_PPAS is set to " ".join(extra_ppas))
+ EXTRA_SNAPS   (optional, comes from "extra_snaps" in the metadata
+                "extra_snaps" is a list. EXTRA_SNAPS is set to " ".join(extra_snaps))
+
+Here is an opinionated and slightly angry attempt to describe what
+each of these is for:
+
+PROJECT
+-------
+
+This is the big one, the main variable that defines what is being
+built. It can be ubuntu, ubuntu-server, xubuntu, ubuntu-mini-iso, that
+sort of thing. Generally PROJECT determines the set of packages
+installed but it (unfortunately?) has a bit more impact than that.
+
+It's unarguable that we need a parameter like this.
+
+ARCH
+----
+
+The architecture being built for. This is always the same as `dpkg
+--print-architecture` for us, we don't do any cross builds.
+
+It's kind of redundant but it's not really a problem that this exists.
+
+SUBPROJECT
+----------
+
+This is used for some builds to build a different sort of build of the
+project. It can be set to:
+
+ * "minimized" for ubuntu-cpc builds to make a minimal cloud image
+ * "minimal" for xubuntu builds to make a smaller ISO
+ * "desktop-preinstalled" for ubuntu builds to make a preinstalled
+   image instead of the parts for an installer.
+ * "buildd" for images to be used as build images by craft tools, and also
+   buildd chroots used on launchpad builders?
+ * "live" for ubuntu-server builds, historically to distinguish d-i
+   style installers from subiquity style installers
+ * "desktop" for ubuntu-core-installer builds, to influence which
+   model is use to build the ubuntu core system that will be
+   installed.
+
+_This_ parameter is a total mess. The desktop-preinstalled use feels
+particularly egregious.
+
+SUBARCH
+-------
+
+This identifies the target machine more specifically than ARCH,
+e.g. "tegra-jetson" or "licheerv". Used mostly but not exclusively for
+preinstalled builds.
+
+We probably do need something like this.
+
+CHANNEL
+-------
+
+Influences which channel snaps included in the build are taken from
+(via a few different mechanisms).
+
+IMAGE_TARGETS
+-------------
+
+Passed for CPC (and ubuntu-oem, for some reason) builds to
+`config/hooks.d/make-hooks` which uses it to select which binary hooks
+to run (and so determines which artifacts get produced).
+
+It is probably reasonable that this exists.
+
+REPO_SNAPSHOT_STAMP
+-------------------
+
+Currently unused.
+
+SNAPSHOT_SERVICE_TIMESTAMP
+--------------------------
+
+Also currently unused, and unclear how it differs from
+REPO_SNAPSHOT_STAMP.
+
+COHORT_KEY
+----------
+
+Used to make sure that different builds run at the same time don't get
+different versions of snaps due to phasing differences.
+
+This is a totally valid thing to need to supply.
+
+http_proxy / HTTP_PROXY / LB_APT_HTTP_PROXY
+-------------------------------------------
+
+Nothing complex here!
+
+SUITE
+-----
+
+This is the series being built (e.g. noble, questing). It is misnamed
+really -- a suite is usually a combination of a series and a pocket
+(noble-proposed, questing-security).
+
+As with ARCH this is sort of redundant as we do builds in a chroot of
+the series being built but OTOH it is definitely information the
+build needs to know!
+
+NOW
+---
+
+The serial for the build, e.g. 20250519 or 20240418.4.
+
+It is a totally reasonable parameter.
+
+IMAGEFORMAT
+-----------
+
+This is one of the more incoherently handled parameters. In rough
+outline it is the filesystem of the image we produce.
+
+Installer builds do not produce raw images, so this ends up being set
+to 'plain' (which causes live-build to just leave the rootfs as a
+directory tree) or 'none' (which causes live-build to do roughly the
+same thing but in a different way?).
+
+Image builds that use ubuntu-image set it to "ubuntu-image". These
+builds do not call 'lb build' or 'lb binary'.
+
+Other preinstalled images (mostly cpc images) set it to ext4 (but then
+use live-build/ubuntu-cpc/hooks.d/remove-implicit-artifacts to remove
+the output file that this causes live-build to produce...). Some
+projects rely on this being set via metadata when building the project
+it seems.
+
+It can be set when starting an image build, but most builds do not and
+the behavior when it is not set explicitly is pretty confusing.
+
+This place is not a place of honor.
+
+PROPOSED
+--------
+
+Should packages from proposed by included?
+
+This is not really as useful as it used to be for a bunch of reasons
+but it conceptually makes sense.
+
+EXTRA_PPAS
+----------
+
+Extra archives to get packages from.
+
+This is a space separated list by the time it gets to
+livecd-rootfs. Each element of the list is of the form USER/NAME[:PIN]
+where user is a Launchpad user/team name, NAME is the name of the ppa
+to add and the optional colon-PIN at the end is the value to pin (in
+the "man 5 apt_preferences: sense) packages from this PPA at.
+
+Production builds shouldn't really use this but it's definitely useful
+for development.
+
+EXTRA_SNAPS
+-----------
+
+Extra snaps to include (but only for ubuntu-image based builds).

debian/.gitignore

@@ -0,0 +1 @@
+files

debian/compat

@@ -1 +0,0 @@
-7

debian/control

@@ -1,10 +1,12 @@
 Source: livecd-rootfs
 Section: devel
 Priority: optional
-Build-Depends: debhelper (>= 7)
+Build-Depends: debhelper-compat (= 13)
 Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
-Standards-Version: 3.9.6
+Standards-Version: 4.7.0
 Vcs-Git: https://git.launchpad.net/livecd-rootfs -b ubuntu/master
+Vcs-Browser: https://git.launchpad.net/livecd-rootfs
+Rules-Requires-Root: no
 
 Package: livecd-rootfs
 Architecture: any
@@ -12,6 +14,7 @@ Depends: ${misc:Depends},
          apt-utils,
          attr,
          debootstrap,
+         devscripts,
          distro-info,
          dosfstools,
          e2fsprogs,
@@ -22,27 +25,31 @@ Depends: ${misc:Depends},
          git,
          gnupg,
          grep-dctrl,
+         jq,
          kpartx,
          live-build (>= 3.0~a57-1ubuntu31~),
          lsb-release,
          lzma,
          make,
+         mount,
+         mtools [!i386],
          parted,
          procps,
          python3,
          python3-apt,
-         python3-launchpadlib,
+         python3-launchpadlib [!i386],
          python3-yaml,
          qemu-utils [!i386],
-         rsync,
+         rsync [!i386],
          snapd (>= 2.39) [!i386],
          squashfs-tools (>= 1:3.3-1),
          sudo,
-         u-boot-tools [armhf arm64],
+         u-boot-tools [arm64 armhf],
-         ubuntu-image [!i386 !riscv64],
          python3-vmdkstream [amd64 i386],
+         xorriso [!i386],
          xz-utils,
-         zerofree
+         zerofree,
+         zstd
 Breaks: ubuntu-defaults-builder (<< 0.32)
 Description: construction script for the livecd rootfs
  livecd-rootfs provides the script used to create the root filesystem

debian/copyright

@@ -11,7 +11,7 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 General Public License for more details.
 
 You should have received a copy of the GNU General Public License with
-your Ubuntu system, in /usr/share/common-licenses/GPL, or with the
+your Ubuntu system, in /usr/share/common-licenses/GPL-2, or with the
 livecd-rootfs source package as the file COPYING.  If not, write to
 the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 Boston, MA 02110-1301 USA.

debian/gbp.conf

@@ -1,3 +1,4 @@
 [DEFAULT]
 debian-branch=ubuntu/master
 debian-tag = %(version)s
+dch-opt = --vendor=debian

debian/install

@@ -2,7 +2,6 @@ auto-markable-pkgs usr/share/livecd-rootfs
 live-build usr/share/livecd-rootfs
 get-ppa-fingerprint usr/share/livecd-rootfs
 minimize-manual usr/share/livecd-rootfs
-magic-proxy usr/share/livecd-rootfs
-lp-in-release usr/share/livecd-rootfs
 checkout-translations-branch usr/share/livecd-rootfs
 update-source-catalog usr/share/livecd-rootfs
+sync-mtime usr/share/livecd-rootfs

debian/livecd-rootfs.lintian-overrides

@@ -0,0 +1,10 @@
+# This is expected and okay
+livecd-rootfs: service-file-is-not-a-file [usr/share/livecd-rootfs/*.service]
+livecd-rootfs: uses-dpkg-database-directly [usr/share/livecd-rootfs/live-build/lb_chroot_layered]
+livecd-rootfs: package-contains-no-arch-dependent-files
+
+# Developer documentation in an already-expected spot
+livecd-rootfs: package-contains-documentation-outside-usr-share-doc [usr/share/livecd-rootfs/live-build/ubuntu-cpc/README.cpc.md]
+
+# This is going to occur quite a bit; we're making a livefs
+livecd-rootfs: repeated-path-segment * [*]

debian/source/lintian-overrides

@@ -0,0 +1,5 @@
+# This is expected and okay
+livecd-rootfs source: absolute-symbolic-link-target-in-source * [live-build/*]
+
+# The description indicates that it's not required in debhelper >= 13, which we have
+livecd-rootfs source: override_dh_auto_test-does-not-check-DEB_BUILD_OPTIONS [debian/rules:*]

debian/tests/control

@@ -1,7 +1,7 @@
 Tests: default-bootstraps
 Depends: @, lsb-release
-Restrictions: needs-root isolation-machine
+Restrictions: needs-root isolation-machine allow-stderr
 
 Tests: minimized
 Depends: @, lsb-release
-Restrictions: needs-root isolation-machine
+Restrictions: needs-root isolation-machine allow-stderr

debian/tests/default-bootstraps

@@ -14,39 +14,40 @@ fi
 # but this list gives reasonable coverage.
 ALL_TRIPLETS="
  edubuntu::
- edubuntu-dvd::
  kubuntu::
- kubuntu-active::
- kubuntu-dvd::
- kubuntu-plasma5::
  lubuntu::
- mythbuntu::
+ ubuntu-unity::
  ubuntu::
- ubuntu:canary:
  ubuntu-base::
  ubuntu-base:buildd:
  ubuntu-budgie::
  ubuntu-budgie-desktop::
  ubuntu-budgie-live::
+ ubuntucinnamon::
  ubuntu-core:system-image:ubuntu-core
  ubuntu-cpc::ubuntu-cpc
  ubuntu-cpc:minimized:ubuntu-cpc
  ubuntu-dvd::
- ubuntu-gnome::
  ubuntukylin::
  ubuntu-mate::
  ubuntu-mate-core::
  ubuntu-mate-desktop::
  ubuntu-mate-live::
- ubuntu-netbook::
+ ubuntu-server:live:ubuntu-server
- ubuntu-server::
+ xubuntu::
- xubuntu::"
+ xubuntu:minimal:"
+
+ARCH=$(dpkg --print-architecture)
 
 if [ -z "$SELECTED_TRIPLETS" ]; then
     SELECTED_TRIPLETS="
  ubuntu-base::
  ubuntu-cpc::ubuntu-cpc
 "
+    if [ "$ARCH" = amd64 ]; then
+        SELECTED_TRIPLETS="$SELECTED_TRIPLETS
+ubuntu::"
+    fi
 fi
 
 live_build_rootfs() {
@@ -54,7 +55,6 @@ live_build_rootfs() {
     local SUBPROJECT_TMP=${1%:*}
     SUBPROJECT=${SUBPROJECT_TMP#*:}
     TEMPLATE=${1##*:}
-    ARCH=$(dpkg --print-architecture)
     echo "Building rootfs for project: '$PROJECT' subproject: '$SUBPROJECT' template: '$TEMPLATE' in $PWD"
     cp -a /usr/share/livecd-rootfs/live-build/auto .
     if [ -n "$TEMPLATE" ]; then
@@ -64,19 +64,22 @@ live_build_rootfs() {
          SUBPROJECT=$SUBPROJECT \
          SUITE=$SUITE \
          ARCH=$ARCH \
+         NOW=$(date '+%Y%m%d') \
          lb config
     mkdir chroot
     # this part needs root rights, but right now the whole script ran as root by autopkgtest
     env PROJECT=$PROJECT \
          SUBPROJECT=$SUBPROJECT \
          ARCH=$ARCH \
+         NOW=$(date '+%Y%m%d') \
          lb build
     echo "Build results for project: '$PROJECT' subproject: '$SUBPROJECT' template: '$TEMPLATE' in $PWD"
     du -sh *
     echo ""
 }
 
-WORKDIR=$(mktemp -d)
+[ -d /adt ] || mkdir /adt
+WORKDIR=$(mktemp -d -p /adt)
 trap "RET=\$?; rm -rf $WORKDIR; exit \$RET" 0 INT QUIT ABRT PIPE TERM
 cd $WORKDIR
 

live-build/apparmor/6.11/capability

@@ -0,0 +1 @@
+0xffffff

live-build/apparmor/6.11/caps/extended

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/caps/mask

@@ -0,0 +1 @@
+chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon bpf checkpoint_restore

live-build/apparmor/6.11/dbus/mask

@@ -0,0 +1 @@
+acquire send receive

live-build/apparmor/6.11/domain/attach_conditions/xattr

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/domain/change_hat

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/domain/change_hatv

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/domain/change_onexec

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/domain/change_profile

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/domain/computed_longest_left

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/domain/disconnected.path

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/domain/fix_binfmt_elf_mmap

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/domain/interruptible

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/domain/kill.signal

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/domain/post_nnp_subset

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/domain/stack

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/domain/unconfined_allowed_children

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/domain/version

@@ -0,0 +1 @@
+1.2

live-build/apparmor/6.11/file/mask

@@ -0,0 +1 @@
+create read write exec append mmap_exec link lock

live-build/apparmor/6.11/io_uring/mask

@@ -0,0 +1 @@
+sqpoll override_creds

live-build/apparmor/6.11/ipc/posix_mqueue

@@ -0,0 +1 @@
+create read write open delete setattr getattr

live-build/apparmor/6.11/mount/mask

@@ -0,0 +1 @@
+mount umount pivot_root

live-build/apparmor/6.11/mount/move_mount

@@ -0,0 +1 @@
+detached

live-build/apparmor/6.11/namespaces/mask

@@ -0,0 +1 @@
+userns_create

live-build/apparmor/6.11/namespaces/pivot_root

@@ -0,0 +1 @@
+no

live-build/apparmor/6.11/namespaces/profile

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/namespaces/userns_create

@@ -0,0 +1 @@
+pciu&

live-build/apparmor/6.11/network/af_mask

@@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp

live-build/apparmor/6.11/network/af_unix

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/network_v8/af_inet

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/network_v8/af_mask

@@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp

live-build/apparmor/6.11/policy/notify/user

@@ -0,0 +1 @@
+file

live-build/apparmor/6.11/policy/outofband

@@ -0,0 +1 @@
+0x000001

live-build/apparmor/6.11/policy/permstable32

@@ -0,0 +1 @@
+allow deny subtree cond kill complain prompt audit quiet hide xindex tag label

live-build/apparmor/6.11/policy/permstable32_version

@@ -0,0 +1 @@
+0x000003

live-build/apparmor/6.11/policy/set_load

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/policy/state32

@@ -0,0 +1 @@
+0x000001

live-build/apparmor/6.11/policy/unconfined_restrictions/change_profile

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/policy/unconfined_restrictions/io_uring

@@ -0,0 +1 @@
+0

live-build/apparmor/6.11/policy/unconfined_restrictions/userns

@@ -0,0 +1 @@
+1

live-build/apparmor/6.11/policy/versions/v5

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/policy/versions/v6

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/policy/versions/v7

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/policy/versions/v8

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/policy/versions/v9

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/ptrace/mask

@@ -0,0 +1 @@
+read trace

live-build/apparmor/6.11/query/label/data

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/query/label/multi_transaction

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.11/query/label/perms

@@ -0,0 +1 @@
+allow deny audit quiet

live-build/apparmor/6.11/rlimit/mask

@@ -0,0 +1 @@
+cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime

live-build/apparmor/6.11/signal/mask

@@ -0,0 +1 @@
+hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost

live-build/apparmor/6.12/capability

@@ -0,0 +1 @@
+0xffffff

live-build/apparmor/6.12/caps/extended

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/caps/mask

@@ -0,0 +1 @@
+chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon bpf checkpoint_restore

live-build/apparmor/6.12/dbus/mask

@@ -0,0 +1 @@
+acquire send receive

live-build/apparmor/6.12/domain/attach_conditions/xattr

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/domain/change_hat

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/domain/change_hatv

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/domain/change_onexec

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/domain/change_profile

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/domain/computed_longest_left

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/domain/disconnected.path

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/domain/fix_binfmt_elf_mmap

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/domain/interruptible

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/domain/kill.signal

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/domain/post_nnp_subset

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/domain/stack

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/domain/unconfined_allowed_children

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/domain/version

@@ -0,0 +1 @@
+1.2

live-build/apparmor/6.12/file/mask

@@ -0,0 +1 @@
+create read write exec append mmap_exec link lock

live-build/apparmor/6.12/io_uring/mask

@@ -0,0 +1 @@
+sqpoll override_creds

live-build/apparmor/6.12/ipc/posix_mqueue

@@ -0,0 +1 @@
+create read write open delete setattr getattr

live-build/apparmor/6.12/mount/mask

@@ -0,0 +1 @@
+mount umount pivot_root

live-build/apparmor/6.12/mount/move_mount

@@ -0,0 +1 @@
+detached

live-build/apparmor/6.12/namespaces/mask

@@ -0,0 +1 @@
+userns_create

live-build/apparmor/6.12/namespaces/pivot_root

@@ -0,0 +1 @@
+no

live-build/apparmor/6.12/namespaces/profile

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/namespaces/userns_create

@@ -0,0 +1 @@
+pciu&

live-build/apparmor/6.12/network/af_mask

@@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp

live-build/apparmor/6.12/network/af_unix

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/network_v8/af_inet

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/network_v8/af_mask

@@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp

live-build/apparmor/6.12/policy/notify/user

@@ -0,0 +1 @@
+file

live-build/apparmor/6.12/policy/outofband

@@ -0,0 +1 @@
+0x000001

live-build/apparmor/6.12/policy/permstable32

@@ -0,0 +1 @@
+allow deny subtree cond kill complain prompt audit quiet hide xindex tag label

live-build/apparmor/6.12/policy/permstable32_version

@@ -0,0 +1 @@
+0x000003

live-build/apparmor/6.12/policy/set_load

@@ -0,0 +1 @@
+yes

live-build/apparmor/6.12/policy/state32

@@ -0,0 +1 @@
+0x000001