[Bug 2024639] Re: apparmor features overrides for specific kernels never restored

[Łukasz Zemczak]

Hello Thomas, or anyone else affected,

Accepted livecd-rootfs into jammy-proposed. The package will build now
and be available at https://launchpad.net/ubuntu/+source/livecd-
rootfs/2.765.24 in a few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, what testing has been
performed on the package and change the tag from verification-needed-
jammy to verification-done-jammy. If it does not fix the bug for you,
please add a comment stating that, and change the tag to verification-
failed-jammy. In either case, without details of your testing we will
not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: livecd-rootfs (Ubuntu Jammy)
       Status: New => Fix Committed

** Tags added: verification-needed verification-needed-jammy

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/2024639

Title:
  apparmor features overrides for specific kernels never restored

Status in livecd-rootfs package in Ubuntu:
  New
Status in livecd-rootfs source package in Jammy:
  Fix Committed

Bug description:
  Recent changes (commit bd1690bd16c70f9631, bug is
  https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2015596)
  added a feature to livecd-rootfs to adjust the apparmor features for
  preseeding.

  But CPC builds do use derivative images. In that case, it's
  eg. possible that an image has kernel 5.19 installed (which would
  trigger the modification of apparmor features on the filesystem) and a
  derivate image (eg. the realtime kernel image) does then install a
  5.15 kernel. In that case the modifications from the 5.19 kernel would
  still be visible in /sys/kernel/security/apparmor/features/ and the
  preseeding optimizations fail.

  That's visible by calling "snap debug seeding":

  # uname -a
  Linux ip-172-31-28-91 5.15.0-1039-realtime #42-Ubuntu SMP PREEMPT_RT Wed May 17 20:46:21 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux
  # diff -u <(snap debug seeding|yq -P '.preseed-system-key') <(snap debug seeding|yq -P '.seed-restart-system-key')
  --- /dev/fd/63	2023-06-22 07:55:00.603927264 +0000
  +++ /dev/fd/62	2023-06-22 07:55:00.604927242 +0000
  @@ -3,7 +3,6 @@
     - dbus
     - domain
     - file
  -  - ipc
     - mount
     - namespaces
     - network

  [Impact]
  For some images (eg. the realtime kernel images) the preseed optimizations do not work. That affects bootspeed

  [Test Plan]
  * Build images with the fix and boot the image
  * make sure the output is:

  # snap debug seeding
  seeded:            true
  preseeded:         true
  image-preseeding:  13.682s
  seed-completion:   4.684s

  [Where problems could occur]
  Snap seed may not be validated correctly and fail CPC automation test, which will block image publication

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2024639/+subscriptions