[Bug 2024639] Re: apparmor features overrides for specific kernels never restored
John Chittum
2024639 at bugs.launchpad.net
Mon Aug 21 23:15:00 UTC 2023
due to the overlap between features, I've verified this with a CPC
specific image. This is a copy/paste of the comment in
https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2031943 ,
as the verification steps, as far as getting the deb-source, building an
image that uses a different kernel, and ensuring the directory is
mounted and the proper features set.
This needs further validation of other cases (i'll put that in a
separate comment)
Test case and instructions
1. downloaded deb-source of proposed-livecd-rootfs
1a. lxc launch ubuntu:j
1b. apt update && apt install dpkg-dev (to download the deb source)
1c. enable `proposed` in sources.list
1d. sudo apt-get source livecd-rootfs=2.765.24
1e. exit container and lxc file pull source
2. using `ubuntu-bartender` from `ubuntu-old-fashioned`, run a build that requires the 6.2 kernel and does snap preseeding
2a. in this case, built an project=ubuntu-cpc image-target=gce
* NOTE: This requires cpc secret sauce to build. Unfortunately, there aren't any images in non-secret-sauce that use the HWE kernel.
3. Check for copying / mounting 6.2 kernel features in the code. log snippet:
+ snap_validate_seed mountpoint_gce
+ local CHROOT_ROOT=mountpoint_gce
+ '[' -e mountpoint_gce/boot/vmlinuz ']'
++ readlink --canonicalize --no-newline mountpoint_gce/boot/vmlinuz
++ grep --extended-regexp --only-matching --max-count 1 '[0-9]+\.[0-9]+'
+ local kern_major_min=6.2
+ '[' -d /usr/share/livecd-rootfs/live-build/apparmor/6.2 ']'
+ umount mountpoint_gce/sys/kernel/security/apparmor/features/
+ mount --bind /usr/share/livecd-rootfs/live-build/apparmor/6.2 mountpoint_gce/sys/kernel/security/apparmor/features/
+ '[' -e mountpoint_gce/var/lib/snapd/seed/seed.yaml ']'
+ snap debug validate-seed mountpoint_gce/var/lib/snapd/seed/seed.yaml
++ realpath mountpoint_gce
+ /usr/lib/snapd/snap-preseed --reset /build/mountpoint_gce
++ realpath mountpoint_gce
+ /usr/lib/snapd/snap-preseed /build/mountpoint_gce
ubuntu classic preseeding
starting to preseed root: /build/mountpoint_gce
using snapd binary: /tmp/snapd-preseed/usr/lib/snapd/snapd (2.59.5)
2023/08/21 21:25:46.286526 main.go:57: running for preseeding
2023/08/21 21:25:46.310274 overlord.go:272: Acquiring state lock file
2023/08/21 21:25:46.310292 overlord.go:277: Acquired state lock file
2023/08/21 21:25:46.354527 daemon.go:247: started snapd/2.59.5 (series 16; classic) ubuntu/22.04 (amd64) linux/5.15.0-1041-aws.
2023/08/21 21:25:46.370960 daemon.go:340: adjusting startup timeout by 30s (pessimistic estimate of 30s plus 5s per snap)
2023/08/21 21:25:46.382935 backends.go:58: AppArmor status: apparmor is enabled and all features are available
2023/08/21 21:25:46.889313 helpers.go:146: error trying to compare the snap system key: system-key missing on disk
2023/08/21 21:25:58.334026 daemon.go:428: stopping snapd as requested
2023/08/21 21:25:58.349910 daemon.go:521: gracefully waiting for running hooks
2023/08/21 21:25:58.349930 daemon.go:523: done waiting for running hooks
2023/08/21 21:25:58.350457 overlord.go:516: Released state lock file
unmounting: /tmp/snapd-preseed
4. register the image in GCE
4a. push resultant builds tar.gz to a bucket
4b. register an image by pointing to the file in the bucket
* NOTE: this elides a few details. I used a Canonical internal only tool to speed this up.
5. boot the image as an instance and check kernel and snap debug preseeding
john.chittum at test-snap-preseed-jammy-62:~$ sudo snap debug seeding
seeded: true
preseeded: true
image-preseeding: 11.433s
seed-completion: 17.179s
john.chittum at test-snap-preseed-jammy-62:~$ uname -a
Linux test-snap-preseed-jammy-62 6.2.0-1011-gcp #11~22.04.1-Ubuntu SMP Wed Aug 2 05:19:58 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
this validates that the 6.2 kernel apparmor info was mounted, and snap
preseeding done with the proper set of features and capabilities.
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/2024639
Title:
apparmor features overrides for specific kernels never restored
Status in livecd-rootfs package in Ubuntu:
New
Status in livecd-rootfs source package in Jammy:
Fix Committed
Bug description:
Recent changes (commit bd1690bd16c70f9631, bug is
https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2015596)
added a feature to livecd-rootfs to adjust the apparmor features for
preseeding.
But CPC builds do use derivative images. In that case, it's
eg. possible that an image has kernel 5.19 installed (which would
trigger the modification of apparmor features on the filesystem) and a
derivate image (eg. the realtime kernel image) does then install a
5.15 kernel. In that case the modifications from the 5.19 kernel would
still be visible in /sys/kernel/security/apparmor/features/ and the
preseeding optimizations fail.
That's visible by calling "snap debug seeding":
# uname -a
Linux ip-172-31-28-91 5.15.0-1039-realtime #42-Ubuntu SMP PREEMPT_RT Wed May 17 20:46:21 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux
# diff -u <(snap debug seeding|yq -P '.preseed-system-key') <(snap debug seeding|yq -P '.seed-restart-system-key')
--- /dev/fd/63 2023-06-22 07:55:00.603927264 +0000
+++ /dev/fd/62 2023-06-22 07:55:00.604927242 +0000
@@ -3,7 +3,6 @@
- dbus
- domain
- file
- - ipc
- mount
- namespaces
- network
[Impact]
For some images (eg. the realtime kernel images) the preseed optimizations do not work. That affects bootspeed
[Test Plan]
* Build images with the fix and boot the image
* make sure the output is:
# snap debug seeding
seeded: true
preseeded: true
image-preseeding: 13.682s
seed-completion: 4.684s
[Where problems could occur]
Snap seed may not be validated correctly and fail CPC automation test, which will block image publication
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2024639/+subscriptions
More information about the foundations-bugs
mailing list