[Bug 2031943] Re: 6.2 Kernel Apparmor Feature Mismatch on Jammy

[Łukasz Zemczak]

Hello John, or anyone else affected,

Accepted livecd-rootfs into jammy-proposed. The package will build now
and be available at https://launchpad.net/ubuntu/+source/livecd-
rootfs/2.765.24 in a few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, what testing has been
performed on the package and change the tag from verification-needed-
jammy to verification-done-jammy. If it does not fix the bug for you,
please add a comment stating that, and change the tag to verification-
failed-jammy. In either case, without details of your testing we will
not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: livecd-rootfs (Ubuntu Jammy)
       Status: New => Fix Committed

** Tags added: verification-needed verification-needed-jammy

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/2031943

Title:
  6.2 Kernel Apparmor Feature Mismatch on Jammy

Status in livecd-rootfs package in Ubuntu:
  Confirmed
Status in livecd-rootfs source package in Jammy:
  Fix Committed

Bug description:
  Ubuntu Jammy 22.04 rolled the HWE kernel to 6.2. This has run into the
  same issue as the 5.19 kernel roll, where the generic apparmor feature
  set being mounted into the build env does not match the 6.2 kernel.
  The same feature is missing

  ipc

  Observable by building an image, booting it, and running `snap debug
  preseeding`. Example output from a GCE image:

  sudo snap debug seeding
  seeded:            true
  preseeded:         true
  image-preseeding:  7.411s
  seed-completion:   13.899s
  preseed-system-key: {
    "apparmor-features": [
      "caps",
      "dbus",
      "domain",
      "file",
      "mount",
      "namespaces",
      "network",
      "network_v8",
      "policy",
      "ptrace",
      "query",
      "rlimit",
      "signal"
    ],
    "apparmor-parser-features": [
      "cap-audit-read",
      "cap-bpf",
      "include-if-exists",
      "mqueue",
      "qipcrtr-socket",
      "unsafe",
      "xdp"
    ],
    "apparmor-parser-mtime": 1666191120,
    "build-id": "4399dbaff2bd50a4ae62c9324bbc96def18bf9a8",
    "cgroup-version": "2",
    "nfs-home": false,
    "overlay-root": "",
    "seccomp-compiler-version": "0f51c115b973679d7ed64b550a8d9d461f7cd5c6 2.5.4 c3c9b282ef3c8dfcc3124b2aeaef62f56b813bfd21f8806b30a6c9dbc2e6e58d bpf-actlog",
    "seccomp-features": [
      "allow",
      "errno",
      "kill_process",
      "kill_thread",
      "log",
      "trace",
      "trap",
      "user_notif"
    ],
    "version": 10
  }
  seed-restart-system-key: {
    "apparmor-features": [
      "caps",
      "dbus",
      "domain",
      "file",
      "ipc",
      "mount",
      "namespaces",
      "network",
      "network_v8",
      "policy",
      "ptrace",
      "query",
      "rlimit",
      "signal"
    ],
    "apparmor-parser-features": [
      "cap-audit-read",
      "cap-bpf",
      "include-if-exists",
      "mqueue",
      "qipcrtr-socket",
      "unsafe",
      "xdp"
    ],
    "apparmor-parser-mtime": 1666191120,
    "build-id": "4399dbaff2bd50a4ae62c9324bbc96def18bf9a8",
    "cgroup-version": "2",
    "nfs-home": false,
    "overlay-root": "",
    "seccomp-compiler-version": "0f51c115b973679d7ed64b550a8d9d461f7cd5c6 2.5.4 c3c9b282ef3c8dfcc3124b2aeaef62f56b813bfd21f8806b30a6c9dbc2e6e58d bpf-actlog",
    "seccomp-features": [
      "allow",
      "errno",
      "kill_process",
      "kill_thread",
      "log",
      "trace",
      "trap",
      "user_notif"
    ],
    "version": 10
  }

  
  [ Impact ] 

   * boot times for all pre-installed images are adversely affected,
  causing issues for cloud partners

  [ Test Plan ]

   * build any cloud image
   * boot
   * run `snap debug preseed`
   * there should not be anything in : seed-restart-system-key

  [ Where problems could occur ]

   * if i didn't get the exact match of features, and seed-restart-system-key is still present
      * thankfully, it tells you the mismatch, so we can iterate and fix
   * without this the 6.2 kernel will not be properly pre-seeded and optimized for first boot deployments.

  [ Other Info ]

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2031943/+subscriptions