AppArmor: various updates including 1 important fix for Debian Trixie

The important bit here is the first commit (692e28a1) which closes Debian#1098845. It would be great to have this merged soon so that the Debian maintainers can include this fix in time for the Trixie freeze.

Everything else is optional. I'm bundling this together to save us all some QA time.

assigned to @intrigeri

changed title from Draft: AppArmor: allow unprivileged user namespaces to Draft: AppArmor: various updates including 1 important fix for Debian Trixie

changed the description

marked this merge request as ready

@asciiwolf, @boklm, is one of you up to reviewing this? Thanks in advance :)

Or perhaps @anonym might want to get involved since this will trickle down to Tails too.

requested review from @boklm

@intrigeri we can include this in Debian now as a patch without issue. We just remove the patch when we have a new version. If it's absolutely critical, that is.

It's not atypical to do distro-level patches that're critical until it's handled upstream, I've had my own set of those for different packages. (doing followup from debian bts)

I'm not an apparmor expert, but the changes (with the comments from the commit messages) make sense to me.

approved this merge request

resolved all threads

mentioned in commit 479b8f53

merged