shadowsocks-libev-apparmor-3.3.6-3.3 RPM for noarch

From OpenSuSE Ports Tumbleweed for noarch

This package adds the Apparmor profile to shadowsocks-libev

Provides

• shadowsocks-libev-apparmor
• config(shadowsocks-libev-apparmor)

Requires

• /bin/sh
• /bin/sh
• config(shadowsocks-libev-apparmor) = 3.3.6-3.3
• rpmlib(CompressedFileNames) <= 3.0.4-1
• rpmlib(FileDigests) <= 4.6.0-1
• rpmlib(PayloadFilesHavePrefix) <= 4.0-1
• rpmlib(PayloadIsZstd) <= 5.4.18-1
• rpmlib(RichDependencies) <= 4.12.0-1
• shadowsocks-libev = 3.3.6-3.3

License

GPL-3.0-or-later

Changelog

* Wed Jun 24 2026 Martin Pluskal <mpluskal@suse.com>
  - Build against the mbedtls 3.6 LTS line: switch BuildRequires from
    mbedtls-devel to mbedtls-3-devel. mbedtls 4.x removed the legacy
    mbedtls_cipher_* abstraction layer that shadowsocks-libev relies
    on (a proper fix needs a PSA-crypto port upstream), so track the
    3.6 LTS package which keeps the stable public API.
* Mon May 18 2026 Hillwood Yang <hillwoodroc@gmail.com>
  - Comprehensive systemd service hardening (bnc#1212862 and boo#1263916)
    * Add CAP_DAC_READ_SEARCH to AmbientCapabilities/CapabilityBoundingSet
      to allow reading certificates from restricted dynamic paths.
    * Ensures v2ray-plugin can access Let's Encrypt keys reliably.
    * Restrict root powers using CapabilityBoundingSet (minimal privileges).
    * Isolate filesystem via ProtectSystem=full and ProtectHome=true.
    * Whitelist binary and config access with ReadOnlyPaths.
    * Disable kernel/device modifications (ProtectKernel*, PrivateDevices).
    * Introduce SELinux and AppArmor as optional security hardening schemes,
      and add shadowsocks-libev-selinux and shadowsocks-libev-apparmory
      subpackages.
  - Integrate shadowsocks-sysuser for proper non-privileged user handling
    (boo#1264355).
* Tue May 05 2026 Hillwood Yang <hillwood@opensuse.org>
  - Update version to 3.3.6
    * Reduce memory copies in crypto encrypt/decrypt paths
    * Fix unbounded buffer growth in aead_decrypt chunk reassembly
  - Add shadowsocks-libev-gcc13-compat.patch, fix build with gcc13
  - Drop 001-migrate-to-mbedtls-3.patch, 002-migrate-to-mbedtls-3.patch and
    shadowsocks-libev-3.3.5-pcre2.patch
  - Run ss-server with root privileges to allow binding to privileged ports
    and reading SSL certificates (boo#1263916)
  - All services have been switched to Type=simple mode, and PID file usage
    has been removed (boo#1263914)
* Sun Apr 05 2026 Hillwood Yang <hillwood@opensuse.org>
  - Migrate to mbedtls 3(boo#1261529)
    * Add 001-migrate-to-mbedtls-3.patch
    * Add 002-migrate-to-mbedtls-3.patch
* Sun Jul 06 2025 Robert Munteanu <rombert@apache.org>
  - Create /run/shadowsocks using tmpfiles, otherwise systemd services
    fail to start
* Sat Mar 29 2025 Andreas Stieger <andreas.stieger@gmx.de>
  - port to pcre2, add shadowsocks-libev-3.3.5-pcre2.patch based on
    https://github.com/shadowsocks/shadowsocks-libev/pull/1792
* Mon Jan 06 2025 Hillwood Yang <hillwood@opensuse.org>
  - Fix start failure by systemd
    * Make sure /etc/shadowsocks can be read by shadowsocks user
    * Create the PID under /run/shadowsocks
* Wed Dec 13 2023 Hillwood Yang <hillwood@opensuse.org>
  - Set permissions as 640 for /etc/shadowsocks (boo#1216372)
* Tue Oct 24 2023 Hillwood Yang <hillwood@opensuse.org>
  - Fix boo#1216372 and boo#1216373, run systemd service as a dedicated user and group
* Mon May 08 2023 Jaime Marquínez Ferrándiz <jaime.marquinez.ferrandiz@fastmail.net>
  - Require the mbedtls-devel version to be lower than 3.0.0

Files

/etc/apparmor.d/shadowsocks-libev
/usr/share/licenses/shadowsocks-libev-apparmor
/usr/share/licenses/shadowsocks-libev-apparmor/COPYING

Generated by rpm2html 1.8.1

Fabrice Bellet, Sun Aug 2 03:14:27 2026