[Bug 1950631] Re: [FFe] wrap swtpm in an apparmor profile

[Lena Voytek]

Thank you for finding that! I can get a merge request going for it.
Should I try and get it added in before the version bump?

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to swtpm in Ubuntu.
https://bugs.launchpad.net/bugs/1950631

Title:
  [FFe] wrap swtpm in an apparmor profile

Status in libvirt package in Ubuntu:
  Invalid
Status in swtpm package in Ubuntu:
  Fix Committed

Bug description:
  Dear Release Team,

  Please accept the swtpm apparmor profile as a Jammy FFe.

  PPA: ppa:lvoytek/swtpm-apparmor-profile-jammy

  [Rationale]

  swtpm is being MIRed right now (bug 1948748) and while not (yet, still
  in security revieww) being called out explicitly - adding in the
  apparmor profile is a good addition in regard to security. Eventually
  this is another new guest<->host interface which generally are high
  ranked in attack profiles - so adding another layer (Steve already
  made the user swtpm runs with more safe) of security seems like an
  important thing.

  [Regression Potential]

  If the apparmor profile is missing certain exceptions then some users may encounter permission denied errors with their setup.
  But before Jammy swtpm wasn't in the Archive at all and that isn't released yet - so it can't be felt like a regression. And the profile has the usual means of local includes to allow users to overcome this without too much hazzle.

  swtpm is not seeded (but about to, see MIR bug above).

  [Proposed upload]

  Code:
  https://code.launchpad.net/~lvoytek/ubuntu/+source/swtpm/+git/swtpm/+merge/415813

  Build: https://launchpad.net/~lvoytek/+archive/ubuntu/swtpm-apparmor-
  profile-jammy

  [Tests]

  autopkgtest output:

  ============================================================================
  Testsuite summary for swtpm 0.6.1
  ============================================================================
  # TOTAL: 58
  # PASS:  50
  # SKIP:  8
  # XFAIL: 0
  # FAIL:  0
  # XPASS: 0
  # ERROR: 0
  ============================================================================
  make[3]: Leaving directory '/tmp/autopkgtest.cLbuOZ/build.Gmd/src/tests'
  make[2]: Leaving directory '/tmp/autopkgtest.cLbuOZ/build.Gmd/src/tests'
  make[1]: Leaving directory '/tmp/autopkgtest.cLbuOZ/build.Gmd/src/tests'
  make[1]: Entering directory '/tmp/autopkgtest.cLbuOZ/build.Gmd/src'
  make[1]: Leaving directory '/tmp/autopkgtest.cLbuOZ/build.Gmd/src'
  autopkgtest [10:14:10]: test run-tests: -----------------------]
  autopkgtest [10:14:11]: test run-tests:  - - - - - - - - - - results - - - - - - - - - -
  run-tests            PASS
  autopkgtest [10:14:11]: @@@@@@@@@@@@@@@@@@@@ summary
  run-tests            PASS
  qemu-system-x86_64: terminating on signal 15 from pid 58469 (/usr/bin/python3)

  [Original Description]

  This is a spin off from MIR bug 1948748 for swtpm.

  As we can see in bug 1859506 it currently seems to run in guest-
  context which is good as that is already rather reduced and safer than
  e.g. the libvirt daemon.

  But still we should evaluate adding a further reduced profile just for
  swtpm and have it transition there.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1950631/+subscriptions