[Bug 2024639] Re: apparmor features overrides for specific kernels never restored

John Chittum 2024639 at bugs.launchpad.net
Mon Aug 21 23:15:00 UTC 2023


due to the overlap between features, I've verified this with a CPC
specific image. This is a copy/paste of the comment in
https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2031943 ,
as the verification steps, as far as getting the deb-source, building an
image that uses a different kernel, and ensuring the directory is
mounted and the proper features set.

This needs further validation of other cases (i'll put that in a
separate comment)


Test case and instructions

1. downloaded deb-source of proposed-livecd-rootfs
    1a. lxc launch ubuntu:j
    1b. apt update && apt install dpkg-dev (to download the deb source)
    1c. enable `proposed` in sources.list
    1d. sudo apt-get source livecd-rootfs=2.765.24
    1e. exit container and lxc file pull source
2. using `ubuntu-bartender` from `ubuntu-old-fashioned`, run a build that requires the 6.2 kernel and does snap preseeding
    2a. in this case, built an project=ubuntu-cpc image-target=gce
        * NOTE: This requires cpc secret sauce to build. Unfortunately, there aren't any images in non-secret-sauce that use the HWE kernel.
3. Check for copying / mounting 6.2 kernel features in the code. log snippet:

+ snap_validate_seed mountpoint_gce
+ local CHROOT_ROOT=mountpoint_gce
+ '[' -e mountpoint_gce/boot/vmlinuz ']'
++ readlink --canonicalize --no-newline mountpoint_gce/boot/vmlinuz
++ grep --extended-regexp --only-matching --max-count 1 '[0-9]+\.[0-9]+'
+ local kern_major_min=6.2
+ '[' -d /usr/share/livecd-rootfs/live-build/apparmor/6.2 ']'
+ umount mountpoint_gce/sys/kernel/security/apparmor/features/
+ mount --bind /usr/share/livecd-rootfs/live-build/apparmor/6.2 mountpoint_gce/sys/kernel/security/apparmor/features/
+ '[' -e mountpoint_gce/var/lib/snapd/seed/seed.yaml ']'
+ snap debug validate-seed mountpoint_gce/var/lib/snapd/seed/seed.yaml
++ realpath mountpoint_gce
+ /usr/lib/snapd/snap-preseed --reset /build/mountpoint_gce
++ realpath mountpoint_gce
+ /usr/lib/snapd/snap-preseed /build/mountpoint_gce
ubuntu classic preseeding
starting to preseed root: /build/mountpoint_gce
using snapd binary: /tmp/snapd-preseed/usr/lib/snapd/snapd (2.59.5)
2023/08/21 21:25:46.286526 main.go:57: running for preseeding
2023/08/21 21:25:46.310274 overlord.go:272: Acquiring state lock file
2023/08/21 21:25:46.310292 overlord.go:277: Acquired state lock file
2023/08/21 21:25:46.354527 daemon.go:247: started snapd/2.59.5 (series 16; classic) ubuntu/22.04 (amd64) linux/5.15.0-1041-aws.
2023/08/21 21:25:46.370960 daemon.go:340: adjusting startup timeout by 30s (pessimistic estimate of 30s plus 5s per snap)
2023/08/21 21:25:46.382935 backends.go:58: AppArmor status: apparmor is enabled and all features are available
2023/08/21 21:25:46.889313 helpers.go:146: error trying to compare the snap system key: system-key missing on disk
2023/08/21 21:25:58.334026 daemon.go:428: stopping snapd as requested
2023/08/21 21:25:58.349910 daemon.go:521: gracefully waiting for running hooks
2023/08/21 21:25:58.349930 daemon.go:523: done waiting for running hooks
2023/08/21 21:25:58.350457 overlord.go:516: Released state lock file
unmounting: /tmp/snapd-preseed

4. register the image in GCE
    4a. push resultant builds tar.gz to a bucket
    4b. register an image by pointing to the file in the bucket
        * NOTE: this elides a few details. I used a Canonical internal only tool to speed this up.
5. boot the image as an instance and check kernel and snap debug preseeding

john.chittum at test-snap-preseed-jammy-62:~$ sudo snap debug seeding
seeded: true
preseeded: true
image-preseeding: 11.433s
seed-completion: 17.179s
john.chittum at test-snap-preseed-jammy-62:~$ uname -a
Linux test-snap-preseed-jammy-62 6.2.0-1011-gcp #11~22.04.1-Ubuntu SMP Wed Aug 2 05:19:58 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

this validates that the 6.2 kernel apparmor info was mounted, and snap
preseeding done with the proper set of features and capabilities.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/2024639

Title:
  apparmor features overrides for specific kernels never restored

Status in livecd-rootfs package in Ubuntu:
  New
Status in livecd-rootfs source package in Jammy:
  Fix Committed

Bug description:
  Recent changes (commit bd1690bd16c70f9631, bug is
  https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2015596)
  added a feature to livecd-rootfs to adjust the apparmor features for
  preseeding.

  But CPC builds do use derivative images. In that case, it's
  eg. possible that an image has kernel 5.19 installed (which would
  trigger the modification of apparmor features on the filesystem) and a
  derivate image (eg. the realtime kernel image) does then install a
  5.15 kernel. In that case the modifications from the 5.19 kernel would
  still be visible in /sys/kernel/security/apparmor/features/ and the
  preseeding optimizations fail.

  That's visible by calling "snap debug seeding":

  # uname -a
  Linux ip-172-31-28-91 5.15.0-1039-realtime #42-Ubuntu SMP PREEMPT_RT Wed May 17 20:46:21 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux
  # diff -u <(snap debug seeding|yq -P '.preseed-system-key') <(snap debug seeding|yq -P '.seed-restart-system-key')
  --- /dev/fd/63	2023-06-22 07:55:00.603927264 +0000
  +++ /dev/fd/62	2023-06-22 07:55:00.604927242 +0000
  @@ -3,7 +3,6 @@
     - dbus
     - domain
     - file
  -  - ipc
     - mount
     - namespaces
     - network

  [Impact]
  For some images (eg. the realtime kernel images) the preseed optimizations do not work. That affects bootspeed

  [Test Plan]
  * Build images with the fix and boot the image
  * make sure the output is:

  # snap debug seeding
  seeded:            true
  preseeded:         true
  image-preseeding:  13.682s
  seed-completion:   4.684s

  [Where problems could occur]
  Snap seed may not be validated correctly and fail CPC automation test, which will block image publication

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2024639/+subscriptions




More information about the foundations-bugs mailing list