Interest in backporting AppArmor 5 to Trixie once released?

--Sig_/Fxth79rUOX6cN2C0zzlVXQA
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

Hi,

While working on Whonix (an anonymity-focused hardened Debian
derivative), I discovered that AppArmor 4 is missing fine-grained UNIX
socket mediation. This is a bit of a problem for us, since unrestricted
access to D-Bus can be used to modify the environment systemd starts
new processes with, and can be used to restart services, allowing
an application to escape AppArmor confinement by getting systemd to
restart a service with an LD_PRELOAD environment variable pointed at a
malicious library. We have at least two GUI applications that we cannot
deny UNIX socket access to, and that we also want to stay confined,
which is impossible to do with AppArmor 4 unless running applications
under a different user account (which in our situation is not practical
for a couple of different reasons).

Kernel 6.19 apparently has UNIX socket mediation and D-Bus mediation,
and is available in trixie-backports, but both features require
AppArmor 5, which is still in beta at the moment. It doesn't look like
historically there have been AppArmor userspace backports to Debian
stable releases, so I'm wondering if it would be practical to backport
AppArmor 5 to Trixie once it is released, so that downstreams like
Whonix can take advantage of it.

If the existing maintenance burden of AppArmor in Debian is too high
for this to be practical, I might be able to offer some help.

Thanks,

--
Aaron

--Sig_/Fxth79rUOX6cN2C0zzlVXQA
Content-Type: application/pgp-signature
Content-Description: OpenPGP digital signature

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQS8QsiCjFi4DcDBX+Q5rdye4jrrCAUCacByxQAKCRA5rdye4jrr
CDHCAP9RBHMPd0qgQZHJ/hNx+NeF8RFel2Tx4ZZp5q9RCBawQQEA/rJmkqwkRK7n
m2JH1+1rqV8scCLyy6aJLAkxMalRoQw=
=M3VG
-----END PGP SIGNATURE-----

--Sig_/Fxth79rUOX6cN2C0zzlVXQA--