releasing package livecd-rootfs version 25.10.16

do not completely delete the seed from the live layer
Put the uc20-style system seed for TPM backed FDE in the live layer.
2025-08-14 10:14:10 +00:00 · 2025-08-13 10:34:53 +12:00 · 2025-08-13 10:32:03 +12:00 · 2025-08-13 10:32:03 +12:00 · 2025-08-12 19:37:11 +05:30 · 2025-08-12 19:36:17 +05:30
164 changed files with 1065 additions and 434 deletions
--- a/debian/.gitignore
+++ b/debian/.gitignore
@ -0,0 +1 @@
+files
--- a/debian/changelog
+++ b/debian/changelog
@ -1,3 +1,331 @@
+livecd-rootfs (25.10.16) questing; urgency=medium
+
+  * Put the uc20-style system seed for TPM backed FDE in the live layer.
+
+ -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Wed, 13 Aug 2025 10:34:39 +1200
+
+livecd-rootfs (25.10.15) questing; urgency=medium
+
+  * Add missing components to 6.14 kernel apparmor features' preseeds.
+    (LP: #2116199)
+
+ -- Bryan Alexander <bryan.alexander@canonical.com>  Thu, 17 Jul 2025 13:27:17 -0700
+
+livecd-rootfs (25.10.14) questing; urgency=medium
+
+  [ Didier Roche-Tolomelli ]
+  [ Tim Andersson ]
+  [ Daniel Bungert ]
+  * desktop TPMFDE: move snaps back to stable channels
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Thu, 07 Aug 2025 16:21:32 -0600
+
+livecd-rootfs (25.10.13) questing; urgency=medium
+
+  [ Olivier Gayot ]
+  * Build ubuntu-server with multipath-tools-boot installed, so that the
+    multipath stack ends up present in the initramfs.
+    The LVM stack is already present in the initramfs of the installer. And
+    since kinetic, the /dev/mapper entries for LVM devices are created during
+    the initramfs phase. This is a problem when we have LVM on top of a
+    multipath disk because LVM ends up creating /dev/mapper entries out of
+    /dev/sdX (or /dev/sdXpY) devices, not out of /dev/mapper/mpatha as it
+    should. Adding the multipath stack in the initramfs gives multipath a
+    chance to take ownership of /dev/sdX (or /dev/sdXpY) devices before LVM
+    does (LP: #2080474).
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Thu, 24 Jul 2025 17:37:33 -0600
+
+livecd-rootfs (25.10.12) questing; urgency=medium
+
+  [ Zygmunt Krynicki ]
+  * Use snap wait system seed.loaded to wait for snapd (LP: #2114923)
+
+  [ Dennis Loose ]
+  [ Didier Roche-Tolomelli ]
+  * Allow the ubuntu-desktop-installer to request snap seeding state
+
+ -- Didier Roche-Tolomelli <didrocks@ubuntu.com>  Tue, 15 Jul 2025 16:30:41 +0200
+
+livecd-rootfs (25.10.11) questing; urgency=medium
+
+  * Fix installer startup to wait for snapd to be preseeded first
+    (LP: #2114923)
+
+ -- Didier Roche-Tolomelli <didrocks@ubuntu.com>  Fri, 11 Jul 2025 14:57:56 +0200
+
+livecd-rootfs (25.10.10) questing; urgency=medium
+
+  * risc-v cloud images: enable cpc fixes for riscv64
+
+ -- Adriano Cordova <adriano.cordova@canonical.com>  Tue, 01 Jul 2025 09:11:16 -0400
+
+livecd-rootfs (25.10.9) questing; urgency=medium
+
+  * desktop and server: read $SUBARCH to allow the use of nvidia's kernel
+    instead of generic (LP: #2109822)
+
+ -- Antoine Lassagne <antoine.lassagne@canonical.com>  Tue, 17 Jun 2025 22:23:11 +1200
+
+livecd-rootfs (25.10.8) questing; urgency=medium
+
+  [ Didier Roche-Tolomelli ]
+  * desktop: use snapd from edge
+  * desktop: tpmfde image use desktop-security-center and firmware-updater
+    from edge
+
+  [ Dan Bungert ]
+  * lb_binary_layered: try #2 to fix mtimes in layered squashfses. (LP2107332)
+    Constrain mtime sync to the current upperdir so that files in lower layers
+    are not redundantly included.
+  * server: fix failure to process the hwe kernel layer due to multiple
+    kernels being present (LP: #2112501)
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Fri, 13 Jun 2025 12:00:20 -0600
+
+livecd-rootfs (25.10.7) questing; urgency=medium
+
+  * revert 25.10.6 due to duplicated snaps
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Tue, 10 Jun 2025 07:55:40 -0600
+
+livecd-rootfs (25.10.6) questing; urgency=medium
+
+  * lb_binary_layered: fix mtimes in layered squashfses. (LP: #2107332)
+    Failing to preserve mtime causes unnecessary python pyc rebuilds due to
+    mtime mismatch, and it's generally strange that reinstalling a package
+    that is already installed changes the files on the system (minus
+    intentional differences such as what's going on in the minimized install
+    source).
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Fri, 30 May 2025 17:05:15 -0600
+
+livecd-rootfs (25.10.5) questing; urgency=medium
+
+  * desktop: TPMFDE snapd from latest/edge
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Wed, 28 May 2025 10:27:47 -0600
+
+livecd-rootfs (25.10.4) questing; urgency=medium
+
+  * desktop: TPMFDE kernel from 25.10/candidate
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Sun, 25 May 2025 23:18:59 -0600
+
+livecd-rootfs (25.10.3) questing; urgency=medium
+
+  * desktop: update TPMFDE model and don't skip 020-ubuntu-enhanced-sb.binary.
+    (LP: #2110195)  Temporarily use the model that allows overriding snap
+    channels so we can get matching snaps.
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Fri, 23 May 2025 12:59:40 -0600
+
+livecd-rootfs (25.10.2) questing; urgency=medium
+
+  * desktop: skip 020-ubuntu-enhanced-sb.binary until a matching kernel is
+    ready for snapd 2.68.x
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Tue, 06 May 2025 08:24:10 +0200
+
+livecd-rootfs (25.10.1) questing; urgency=medium
+
+  * desktop: no longer involve cloud-init in early networking (LP: #2107225)
+  * server: provide network config direct to netplan
+  * server: update default netplan config for IPv6 autoconfiguration &
+    connectivity
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Mon, 28 Apr 2025 09:53:34 -0600
+
+livecd-rootfs (25.04.26) plucky; urgency=medium
+
+  * cpc: Restore UseDomains=true in cloud images (LP: #2106729)
+
+ -- Tomáš Virtus <tomas.virtus@canonical.com>  Thu, 10 Apr 2025 13:07:25 +0000
+
+livecd-rootfs (25.04.25) plucky; urgency=medium
+
+  * live-build/auto/build: Use --workdir in ubuntu-image to avoid filling
+    tmpfs-based /tmp (LP: #2103735)
+
+ -- Dave Jones <dave.jones@canonical.com>  Thu, 20 Mar 2025 17:22:47 +0000
+
+livecd-rootfs (25.04.24) plucky; urgency=medium
+
+  * desktop: update TPMFDE model to move pc-kernel to channel 25.04/stable.
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Thu, 13 Mar 2025 17:17:30 -0600
+
+livecd-rootfs (25.04.23) plucky; urgency=medium
+
+  * Add 6.14 kernel apparmor features' preseeds. (LP: #2102120)
+
+ -- Jess Jang <jess.jang@canonical.com>  Wed, 12 Mar 2025 21:08:31 -0500
+
+livecd-rootfs (25.04.22) plucky; urgency=medium
+
+  * server: leave the initrd.img symlink, we want that later for probably
+    several reasons but at least for LP: #2101831
+  * desktop: update TPMFDE model for 25.04.
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Tue, 11 Mar 2025 09:16:03 -0600
+
+livecd-rootfs (25.04.21) plucky; urgency=medium
+
+  * With subiquity builds, setup install-sources to offer bridge kernel.
+  * Add USE_BRIDGE_KERNEL to make it easier to control in the future.
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Wed, 05 Mar 2025 08:18:54 -0700
+
+livecd-rootfs (25.04.20) plucky; urgency=medium
+
+  [ Adriano Cordova ]
+  * riscv: add SUBARCH 'jh7110'. (LP: #2099993)
+
+  [ Michael Hudson-Doyle ]
+  * In ubuntu-server builds, install the first kernel in the base layer, not
+    the "ga" kernel (which may not be installed at all, as is the case in e.g.
+    the arm64+largemem builds).
+  * Again in ubuntu-server builds, configure LAYERFS_PATH in the kernel layer
+    and ensure the initrd is freshly regenerated in that layer. LAYERFS_PATH
+    was being set to the layer below the kernel layer, which meant that the
+    live session did not get access to all the modules in the case that the
+    kernel had not been installed in the base layer, which in turn means that
+    installs fail. (LP: #2100148)
+  * While we're at it, delete any initrd from any other layer than a kernel
+    layer, as they just waste space on the ISO.
+
+ -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Thu, 27 Feb 2025 20:34:01 +1300
+
+livecd-rootfs (25.04.19) plucky; urgency=medium
+
+  * add cpc-sbom to create_manifest calls to generate sboms (LP: #2077105)
+
+ -- Thomas Bechtold <thomasbechtold@jpberlin.de>  Tue, 25 Feb 2025 13:20:49 +0100
+
+livecd-rootfs (25.04.18) plucky; urgency=medium
+
+  [ Michael Hudson-Doyle ]
+  * Pre-emptively include the override to not try to build HWE kernel layer in
+    post .2 server riscv64 ISOs.
+
+  [ Simon Quigley ]
+  * Move from http://ppa.launchpad.net to https://ppa.launchpadcontent.net
+    when specifying EXTRA_PPAS.
+  * Update debhelper compat to 13, no changes needed.
+  * Make the package completely Lintian-clean except for no-dep5-copyright.
+  * Update Standards-Version to 4.7.0, no changes needed.
+  * Add support for multiple pools (/var/lib/{livefs,preinstalled}-pool/).
+
+  [ Simon Poirier ]
+  * increase ubuntu-cpc ppc64el disk size to 2.4G
+
+ -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Thu, 20 Feb 2025 10:24:04 +1300
+
+livecd-rootfs (25.04.17) plucky; urgency=medium
+
+  [ Dan Bungert ]
+  * Fix build failure when using lowlatency-hwe-24.04, as ubuntustudio does.
+    (LP: #2098105)
+
+  [ Michael Hudson-Doyle ]
+  * live-build/ubuntu-mini-iso/hooks/01-mini-iso.binary: Drop the
+    assumption that the uncompressed part of the initrd is unpacked to a
+    directory called "main".
+  * live-build/ubuntu-mini-iso/hooks/01-mini-iso.chroot_early: Fix paths that
+    should have been adjusted when code moved from binary to chroot hook.
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Fri, 14 Feb 2025 17:25:29 +1300
+
+livecd-rootfs (25.04.16) plucky; urgency=medium
+
+  * buildd: add udev to buildd images to fix networking issue. (LP: #2092196)
+
+ -- Simon Poirier <simon.poirier@canonical.com>  Thu, 13 Feb 2025 13:44:02 -0500
+
+livecd-rootfs (25.04.15) plucky; urgency=medium
+
+  * Add 6.12 kernel apparmor features' preseeds.
+
+ -- Thomas Bechtold <thomas.bechtold@canonical.com>  Thu, 13 Feb 2025 12:14:33 +0100
+
+livecd-rootfs (25.04.14) plucky; urgency=medium
+
+  * Restore the default-layer.conf file in the initrd (LP: #2097838)
+
+ -- Dan Bungert <daniel.bungert@canonical.com>  Tue, 11 Feb 2025 08:21:56 -0700
+
+livecd-rootfs (25.04.13) plucky; urgency=medium
+
+  * install-sources: quote default kernel argument.
+  * ubuntu-core-installer: update install-sources.yaml with kernel.
+
+ -- Chris Peterson <chris.peterson@canonical.com>  Wed, 05 Feb 2025 17:43:34 -0800
+
+livecd-rootfs (25.04.12) plucky; urgency=medium
+
+  * Stop producing a rootfs tarball for the ubuntu-mini-iso builds.
+  * Move configuration of casper in ubuntu-serve:live builds to a "chroot
+    early" hook for the installer layer and remove the now unnecessary
+    update-initramfs from the binary hook that breaks because mkinitramfs
+    now requires that /sys is mounted. (LP: #2097280)
+  * Similar changes for ubuntu-mini-iso build.
+
+ -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Wed, 05 Feb 2025 15:26:13 +1300
+
+livecd-rootfs (25.04.11) plucky; urgency=medium
+
+  [ Heinrich Schuchardt ]
+  * riscv: copy device trees dtb/ in ESP
+
+  [ Michael Hudson-Doyle ]
+  * Allow snapd to re-exec in installer environment (the issues between snapd,
+    overlayfs and apparmer that meant re-execing caused problems were fixed in
+    snapd a long time ago).
+
+ -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Wed, 29 Jan 2025 08:51:49 +1300
+
+livecd-rootfs (25.04.10) plucky; urgency=medium
+
+  * riscv: copy device trees to the ESP. Fixes (LP: #2095415)
+
+ -- Adriano Cordova <adriano.cordova@canonical.com>  Tue, 21 Jan 2025 10:38:54 -0300
+
+livecd-rootfs (25.04.9) plucky; urgency=medium
+
+  * Move reference wsl-setup script to /usr/lib/wsl/
+
+ -- Didier Roche-Tolomelli <didrocks@ubuntu.com>  Wed, 22 Jan 2025 10:17:56 +0100
+
+livecd-rootfs (25.04.8) plucky; urgency=medium
+
+  * risc-v: directly copy device trees to /boot/dtbs (LP: #2092205)
+
+ -- Adriano Cordova <adriano.cordova@canonical.com>  Thu, 19 Dec 2024 10:42:57 -0300
+
+livecd-rootfs (25.04.7) plucky; urgency=medium
+
+  [ Carlos Nihelton ]
+  [ Didier Roche-Tolomelli ]
+  * Adapt to new Microsoft package format: (LP: #2091293)
+    - Keep a single wsl rootfs upgrade policy
+    - Create livecd-roots tarball as a .wsl extension
+    - Create wsl-distribution.conf for WSL images
+
+ -- Didier Roche-Tolomelli <didrocks@ubuntu.com>  Mon, 09 Dec 2024 14:29:37 +0100
+
+livecd-rootfs (25.04.6) plucky; urgency=medium
+
+  * Refer to LB_DISTRIBUTION, not SUITE, in the ubuntu-mini-iso binary hook.
+
+ -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Fri, 06 Dec 2024 18:59:35 +1300
+
+livecd-rootfs (25.04.5) plucky; urgency=medium
+
+  * Fix ubuntu-mini-iso build, by using script from debian-cd to create a
+    bootable ISO rather than the now deleted cd-boot-images-amd64 package.
+
+ -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Wed, 04 Dec 2024 13:33:53 +1300
+
 livecd-rootfs (25.04.4) plucky; urgency=medium

  [ Rémy Martin ]
@ -451,7 +779,7 @@ livecd-rootfs (24.04.43) noble; urgency=medium
    grub updates in cloud images (LP: #2054103)

 -- Philip Roche <phil.roche@canonical.com>  Fri, 23 Feb 2024 13:54:57 +0000
- 
+
 livecd-rootfs (24.04.42) noble; urgency=medium

  [ Sean Davis ]
@ -577,8 +905,8 @@ livecd-rootfs (24.04.27) noble; urgency=medium
 livecd-rootfs (24.04.26) noble; urgency=medium

  [ Steve Langasek ]
-  * Share live-build/ubuntu/hooks/020-ubuntu-live.chroot_early across 
-    all flavors using new-style layered squashfs, removing need for 
+  * Share live-build/ubuntu/hooks/020-ubuntu-live.chroot_early across
+    all flavors using new-style layered squashfs, removing need for
    kernel commandline options in debian-cd.

  [ dann frazier ]
@ -710,7 +1038,7 @@ livecd-rootfs (24.04.10) noble; urgency=medium
  * Set C.UTF-8 locale in /etc/default/locale for all images; originally
    intended to be landed in the cosmic cycle..
  * Project name for Ubuntu Studio needs to be 'ubuntustudio-dvd'
-    throughout, not 'ubuntustudio'.  
+    throughout, not 'ubuntustudio'.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 08 Dec 2023 15:07:41 -0800

@ -789,7 +1117,7 @@ livecd-rootfs (24.04.2) noble; urgency=medium
    instead of /boot/vmlinuz. (LP: #2038957)

 -- Philip Roche <phil.roche@canonical.com>  Thu, 26 Oct 2023 17:56:00 +0100
- 
+
 livecd-rootfs (24.04.1) noble; urgency=medium

  [ Steve Langasek ]
--- a/debian/compat
+++ b/debian/compat
@ -1 +0,0 @@
-7
--- a/debian/control
+++ b/debian/control
@ -1,10 +1,12 @@
 Source: livecd-rootfs
 Section: devel
 Priority: optional
-Build-Depends: debhelper (>= 7)
+Build-Depends: debhelper-compat (= 13)
 Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
-Standards-Version: 3.9.6
+Standards-Version: 4.7.0
 Vcs-Git: https://git.launchpad.net/livecd-rootfs -b ubuntu/master
+Vcs-Browser: https://git.launchpad.net/livecd-rootfs
+Rules-Requires-Root: no

 Package: livecd-rootfs
 Architecture: any
--- a/debian/copyright
+++ b/debian/copyright
@ -11,7 +11,7 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 General Public License for more details.

 You should have received a copy of the GNU General Public License with
-your Ubuntu system, in /usr/share/common-licenses/GPL, or with the
+your Ubuntu system, in /usr/share/common-licenses/GPL-2, or with the
 livecd-rootfs source package as the file COPYING.  If not, write to
 the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 Boston, MA 02110-1301 USA.
--- a/debian/install
+++ b/debian/install
@ -4,3 +4,4 @@ get-ppa-fingerprint usr/share/livecd-rootfs
 minimize-manual usr/share/livecd-rootfs
 checkout-translations-branch usr/share/livecd-rootfs
 update-source-catalog usr/share/livecd-rootfs
+sync-mtime usr/share/livecd-rootfs
--- a/debian/livecd-rootfs.lintian-overrides
+++ b/debian/livecd-rootfs.lintian-overrides
@ -0,0 +1,10 @@
+# This is expected and okay
+livecd-rootfs: service-file-is-not-a-file [usr/share/livecd-rootfs/*.service]
+livecd-rootfs: uses-dpkg-database-directly [usr/share/livecd-rootfs/live-build/lb_chroot_layered]
+livecd-rootfs: package-contains-no-arch-dependent-files
+
+# Developer documentation in an already-expected spot
+livecd-rootfs: package-contains-documentation-outside-usr-share-doc [usr/share/livecd-rootfs/live-build/ubuntu-cpc/README.cpc.md]
+
+# This is going to occur quite a bit; we're making a livefs
+livecd-rootfs: repeated-path-segment * [*]
--- a/debian/source/lintian-overrides
+++ b/debian/source/lintian-overrides
@ -0,0 +1,5 @@
+# This is expected and okay
+livecd-rootfs source: absolute-symbolic-link-target-in-source * [live-build/*]
+
+# The description indicates that it's not required in debhelper >= 13, which we have
+livecd-rootfs source: override_dh_auto_test-does-not-check-DEB_BUILD_OPTIONS [debian/rules:*]
--- a/live-build/apparmor/6.12/capability
+++ b/live-build/apparmor/6.12/capability
@ -0,0 +1 @@
+0xffffff
--- a/live-build/apparmor/6.12/caps/extended
+++ b/live-build/apparmor/6.12/caps/extended
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/caps/mask
+++ b/live-build/apparmor/6.12/caps/mask
@ -0,0 +1 @@
+chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon bpf checkpoint_restore
--- a/live-build/apparmor/6.12/dbus/mask
+++ b/live-build/apparmor/6.12/dbus/mask
@ -0,0 +1 @@
+acquire send receive
--- a/live-build/apparmor/6.12/domain/attach_conditions/xattr
+++ b/live-build/apparmor/6.12/domain/attach_conditions/xattr
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/domain/change_hat
+++ b/live-build/apparmor/6.12/domain/change_hat
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/domain/change_hatv
+++ b/live-build/apparmor/6.12/domain/change_hatv
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/domain/change_onexec
+++ b/live-build/apparmor/6.12/domain/change_onexec
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/domain/change_profile
+++ b/live-build/apparmor/6.12/domain/change_profile
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/domain/computed_longest_left
+++ b/live-build/apparmor/6.12/domain/computed_longest_left
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/domain/disconnected.path
+++ b/live-build/apparmor/6.12/domain/disconnected.path
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/domain/fix_binfmt_elf_mmap
+++ b/live-build/apparmor/6.12/domain/fix_binfmt_elf_mmap
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/domain/interruptible
+++ b/live-build/apparmor/6.12/domain/interruptible
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/domain/kill.signal
+++ b/live-build/apparmor/6.12/domain/kill.signal
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/domain/post_nnp_subset
+++ b/live-build/apparmor/6.12/domain/post_nnp_subset
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/domain/stack
+++ b/live-build/apparmor/6.12/domain/stack
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/domain/unconfined_allowed_children
+++ b/live-build/apparmor/6.12/domain/unconfined_allowed_children
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/domain/version
+++ b/live-build/apparmor/6.12/domain/version
@ -0,0 +1 @@
+1.2
--- a/live-build/apparmor/6.12/file/mask
+++ b/live-build/apparmor/6.12/file/mask
@ -0,0 +1 @@
+create read write exec append mmap_exec link lock
--- a/live-build/apparmor/6.12/io_uring/mask
+++ b/live-build/apparmor/6.12/io_uring/mask
@ -0,0 +1 @@
+sqpoll override_creds
--- a/live-build/apparmor/6.12/ipc/posix_mqueue
+++ b/live-build/apparmor/6.12/ipc/posix_mqueue
@ -0,0 +1 @@
+create read write open delete setattr getattr
--- a/live-build/apparmor/6.12/mount/mask
+++ b/live-build/apparmor/6.12/mount/mask
@ -0,0 +1 @@
+mount umount pivot_root
--- a/live-build/apparmor/6.12/mount/move_mount
+++ b/live-build/apparmor/6.12/mount/move_mount
@ -0,0 +1 @@
+detached
--- a/live-build/apparmor/6.12/namespaces/mask
+++ b/live-build/apparmor/6.12/namespaces/mask
@ -0,0 +1 @@
+userns_create
--- a/live-build/apparmor/6.12/namespaces/pivot_root
+++ b/live-build/apparmor/6.12/namespaces/pivot_root
@ -0,0 +1 @@
+no
--- a/live-build/apparmor/6.12/namespaces/profile
+++ b/live-build/apparmor/6.12/namespaces/profile
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/namespaces/userns_create
+++ b/live-build/apparmor/6.12/namespaces/userns_create
@ -0,0 +1 @@
+pciu&
--- a/live-build/apparmor/6.12/network/af_mask
+++ b/live-build/apparmor/6.12/network/af_mask
@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp
--- a/live-build/apparmor/6.12/network/af_unix
+++ b/live-build/apparmor/6.12/network/af_unix
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/network_v8/af_inet
+++ b/live-build/apparmor/6.12/network_v8/af_inet
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/network_v8/af_mask
+++ b/live-build/apparmor/6.12/network_v8/af_mask
@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp
--- a/live-build/apparmor/6.12/policy/notify/user
+++ b/live-build/apparmor/6.12/policy/notify/user
@ -0,0 +1 @@
+file
--- a/live-build/apparmor/6.12/policy/outofband
+++ b/live-build/apparmor/6.12/policy/outofband
@ -0,0 +1 @@
+0x000001
--- a/live-build/apparmor/6.12/policy/permstable32
+++ b/live-build/apparmor/6.12/policy/permstable32
@ -0,0 +1 @@
+allow deny subtree cond kill complain prompt audit quiet hide xindex tag label
--- a/live-build/apparmor/6.12/policy/permstable32_version
+++ b/live-build/apparmor/6.12/policy/permstable32_version
@ -0,0 +1 @@
+0x000003
--- a/live-build/apparmor/6.12/policy/set_load
+++ b/live-build/apparmor/6.12/policy/set_load
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/policy/state32
+++ b/live-build/apparmor/6.12/policy/state32
@ -0,0 +1 @@
+0x000001
--- a/live-build/apparmor/6.12/policy/unconfined_restrictions/change_profile
+++ b/live-build/apparmor/6.12/policy/unconfined_restrictions/change_profile
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/policy/unconfined_restrictions/io_uring
+++ b/live-build/apparmor/6.12/policy/unconfined_restrictions/io_uring
@ -0,0 +1 @@
+0
--- a/live-build/apparmor/6.12/policy/unconfined_restrictions/userns
+++ b/live-build/apparmor/6.12/policy/unconfined_restrictions/userns
@ -0,0 +1 @@
+1
--- a/live-build/apparmor/6.12/policy/versions/v5
+++ b/live-build/apparmor/6.12/policy/versions/v5
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/policy/versions/v6
+++ b/live-build/apparmor/6.12/policy/versions/v6
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/policy/versions/v7
+++ b/live-build/apparmor/6.12/policy/versions/v7
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/policy/versions/v8
+++ b/live-build/apparmor/6.12/policy/versions/v8
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/policy/versions/v9
+++ b/live-build/apparmor/6.12/policy/versions/v9
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/ptrace/mask
+++ b/live-build/apparmor/6.12/ptrace/mask
@ -0,0 +1 @@
+read trace
--- a/live-build/apparmor/6.12/query/label/data
+++ b/live-build/apparmor/6.12/query/label/data
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/query/label/multi_transaction
+++ b/live-build/apparmor/6.12/query/label/multi_transaction
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.12/query/label/perms
+++ b/live-build/apparmor/6.12/query/label/perms
@ -0,0 +1 @@
+allow deny audit quiet
--- a/live-build/apparmor/6.12/rlimit/mask
+++ b/live-build/apparmor/6.12/rlimit/mask
@ -0,0 +1 @@
+cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime
--- a/live-build/apparmor/6.12/signal/mask
+++ b/live-build/apparmor/6.12/signal/mask
@ -0,0 +1 @@
+hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost
--- a/live-build/apparmor/6.14/capability
+++ b/live-build/apparmor/6.14/capability
@ -0,0 +1 @@
+0xffffff
--- a/live-build/apparmor/6.14/caps/extended
+++ b/live-build/apparmor/6.14/caps/extended
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/caps/mask
+++ b/live-build/apparmor/6.14/caps/mask
@ -0,0 +1 @@
+chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon bpf checkpoint_restore
--- a/live-build/apparmor/6.14/dbus/mask
+++ b/live-build/apparmor/6.14/dbus/mask
@ -0,0 +1 @@
+acquire send receive
--- a/live-build/apparmor/6.14/domain/attach_conditions/xattr
+++ b/live-build/apparmor/6.14/domain/attach_conditions/xattr
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/change_hat
+++ b/live-build/apparmor/6.14/domain/change_hat
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/change_hatv
+++ b/live-build/apparmor/6.14/domain/change_hatv
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/change_onexec
+++ b/live-build/apparmor/6.14/domain/change_onexec
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/change_profile
+++ b/live-build/apparmor/6.14/domain/change_profile
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/computed_longest_left
+++ b/live-build/apparmor/6.14/domain/computed_longest_left
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/disconnected.ipc
+++ b/live-build/apparmor/6.14/domain/disconnected.ipc
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/disconnected.path
+++ b/live-build/apparmor/6.14/domain/disconnected.path
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/fix_binfmt_elf_mmap
+++ b/live-build/apparmor/6.14/domain/fix_binfmt_elf_mmap
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/interruptible
+++ b/live-build/apparmor/6.14/domain/interruptible
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/kill.signal
+++ b/live-build/apparmor/6.14/domain/kill.signal
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/post_nnp_subset
+++ b/live-build/apparmor/6.14/domain/post_nnp_subset
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/stack
+++ b/live-build/apparmor/6.14/domain/stack
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/unconfined_allowed_children
+++ b/live-build/apparmor/6.14/domain/unconfined_allowed_children
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/domain/version
+++ b/live-build/apparmor/6.14/domain/version
@ -0,0 +1 @@
+1.2
--- a/live-build/apparmor/6.14/file/mask
+++ b/live-build/apparmor/6.14/file/mask
@ -0,0 +1 @@
+create read write exec append mmap_exec link lock
--- a/live-build/apparmor/6.14/io_uring/mask
+++ b/live-build/apparmor/6.14/io_uring/mask
@ -0,0 +1 @@
+sqpoll override_creds
--- a/live-build/apparmor/6.14/ipc/posix_mqueue
+++ b/live-build/apparmor/6.14/ipc/posix_mqueue
@ -0,0 +1 @@
+create read write open delete setattr getattr
--- a/live-build/apparmor/6.14/mount/mask
+++ b/live-build/apparmor/6.14/mount/mask
@ -0,0 +1 @@
+mount umount pivot_root
--- a/live-build/apparmor/6.14/mount/move_mount
+++ b/live-build/apparmor/6.14/mount/move_mount
@ -0,0 +1 @@
+detached
--- a/live-build/apparmor/6.14/namespaces/mask
+++ b/live-build/apparmor/6.14/namespaces/mask
@ -0,0 +1 @@
+userns_create
--- a/live-build/apparmor/6.14/namespaces/pivot_root
+++ b/live-build/apparmor/6.14/namespaces/pivot_root
@ -0,0 +1 @@
+no
--- a/live-build/apparmor/6.14/namespaces/profile
+++ b/live-build/apparmor/6.14/namespaces/profile
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/namespaces/userns_create
+++ b/live-build/apparmor/6.14/namespaces/userns_create
@ -0,0 +1 @@
+pciu&
--- a/live-build/apparmor/6.14/network/af_mask
+++ b/live-build/apparmor/6.14/network/af_mask
@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp
--- a/live-build/apparmor/6.14/network/af_unix
+++ b/live-build/apparmor/6.14/network/af_unix
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/network_v8/af_inet
+++ b/live-build/apparmor/6.14/network_v8/af_inet
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/network_v8/af_mask
+++ b/live-build/apparmor/6.14/network_v8/af_mask
@ -0,0 +1 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp
--- a/live-build/apparmor/6.14/network_v9/af_mask
+++ b/live-build/apparmor/6.14/network_v9/af_mask
@ -0,0 +1,2 @@
+unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp
+
--- a/live-build/apparmor/6.14/network_v9/af_unix
+++ b/live-build/apparmor/6.14/network_v9/af_unix
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/policy/notify/user
+++ b/live-build/apparmor/6.14/policy/notify/user
@ -0,0 +1 @@
+file
--- a/live-build/apparmor/6.14/policy/outofband
+++ b/live-build/apparmor/6.14/policy/outofband
@ -0,0 +1 @@
+0x000001
--- a/live-build/apparmor/6.14/policy/permstable32
+++ b/live-build/apparmor/6.14/policy/permstable32
@ -0,0 +1 @@
+allow deny subtree cond kill complain prompt audit quiet hide xindex tag label
--- a/live-build/apparmor/6.14/policy/permstable32_version
+++ b/live-build/apparmor/6.14/policy/permstable32_version
@ -0,0 +1 @@
+0x000003
--- a/live-build/apparmor/6.14/policy/set_load
+++ b/live-build/apparmor/6.14/policy/set_load
@ -0,0 +1 @@
+yes
--- a/live-build/apparmor/6.14/policy/state32
+++ b/live-build/apparmor/6.14/policy/state32
@ -0,0 +1 @@
+0x000001
--- a/live-build/apparmor/6.14/policy/unconfined_restrictions/change_profile
+++ b/live-build/apparmor/6.14/policy/unconfined_restrictions/change_profile
@ -0,0 +1 @@
+yes
--- a/Show More
+++ b/Show More
				`@ -0,0 +1 @@`
				`chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon bpf checkpoint_restore`
				`@ -0,0 +1 @@`
				`create read write exec append mmap_exec link lock`
				`@ -0,0 +1 @@`
				`create read write open delete setattr getattr`
				`@ -0,0 +1 @@`
				`unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp`
				`@ -0,0 +1 @@`
				`allow deny subtree cond kill complain prompt audit quiet hide xindex tag label`
				`@ -0,0 +1 @@`
				`cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime`
				`@ -0,0 +1 @@`
				`hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost`
				`@ -0,0 +1,2 @@`
				`unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp mctp`