[Bug 2031943] Re: 6.2 Kernel Apparmor Feature Mismatch on Jammy
Jess Jang
2031943 at bugs.launchpad.net
Tue Aug 22 15:13:35 UTC 2023
Same as above John's comment.
Tested proposed livecd-rootfs with Realtime image AWS which kernel version is 5.15
1. Building image with `ubuntu-bartender` from `ubuntu-old-fashioned`
1a. project=ubuntu-cpc image-target=ec2-pro-realtime
2. Log file check
+ snap_validate_seed /tmp/tmp.ymGEaZ1Bbc
+ local CHROOT_ROOT=/tmp/tmp.ymGEaZ1Bbc
+ '[' -e /tmp/tmp.ymGEaZ1Bbc/boot/vmlinuz ']'
++ readlink --canonicalize --no-newline /tmp/tmp.ymGEaZ1Bbc/boot/vmlinuz
++ grep --extended-regexp --only-matching --max-count 1 '[0-9]+\.[0-9]+'
+ local kern_major_min=5.15
+ '[' -d /usr/share/livecd-rootfs/live-build/apparmor/5.15 ']'
+ '[' -e /tmp/tmp.ymGEaZ1Bbc/var/lib/snapd/seed/seed.yaml ']'
+ snap debug validate-seed /tmp/tmp.ymGEaZ1Bbc/var/lib/snapd/seed/seed.yaml
++ realpath /tmp/tmp.ymGEaZ1Bbc
+ /usr/lib/snapd/snap-preseed --reset /tmp/tmp.ymGEaZ1Bbc
++ realpath /tmp/tmp.ymGEaZ1Bbc
+ /usr/lib/snapd/snap-preseed /tmp/tmp.ymGEaZ1Bbc
ubuntu classic preseeding
starting to preseed root: /tmp/tmp.ymGEaZ1Bbc
using snapd binary: /tmp/snapd-preseed/usr/lib/snapd/snapd (2.59.5)
2023/08/22 13:36:56.513867 main.go:57: running for preseeding
2023/08/22 13:36:56.541899 overlord.go:272: Acquiring state lock file
2023/08/22 13:36:56.541919 overlord.go:277: Acquired state lock file
2023/08/22 13:36:56.594654 daemon.go:247: started snapd/2.59.5 (series 16; classic) ubuntu/22.04 (amd64) linux/5.15.0-1041-aws.
2023/08/22 13:36:56.610803 daemon.go:340: adjusting startup timeout by 30s (pessimistic estimate of 30s plus 5s per snap)
2023/08/22 13:36:56.624055 backends.go:58: AppArmor status: apparmor is enabled and all features are available
2023/08/22 13:36:57.153210 helpers.go:146: error trying to compare the snap system key: system-key missing on disk
2023/08/22 13:37:06.764204 daemon.go:428: stopping snapd as requested
2023/08/22 13:37:06.779818 daemon.go:521: gracefully waiting for running hooks
2023/08/22 13:37:06.779836 daemon.go:523: done waiting for running hooks
2023/08/22 13:37:06.780356 overlord.go:516: Released state lock file
unmounting: /tmp/snapd-preseed
3. register image and check kernel&snap debug seeding result
ubuntu at ip-172-31-26-219:~$ snap debug seeding
seeded: true
preseeded: true
image-preseeding: 8.3s
seed-completion: 3720h29m46.734s
ubuntu at ip-172-31-26-219:~$ uname -a
Linux ip-172-31-26-219 5.15.0-1043-realtime #48-Ubuntu SMP PREEMPT_RT Thu Jul 13 20:54:21 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux
This verification shows snap seeds are validated with correct kernel
version
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/2031943
Title:
6.2 Kernel Apparmor Feature Mismatch on Jammy
Status in livecd-rootfs package in Ubuntu:
Confirmed
Status in livecd-rootfs source package in Jammy:
Fix Committed
Bug description:
Ubuntu Jammy 22.04 rolled the HWE kernel to 6.2. This has run into the
same issue as the 5.19 kernel roll, where the generic apparmor feature
set being mounted into the build env does not match the 6.2 kernel.
The same feature is missing
ipc
Observable by building an image, booting it, and running `snap debug
preseeding`. Example output from a GCE image:
sudo snap debug seeding
seeded: true
preseeded: true
image-preseeding: 7.411s
seed-completion: 13.899s
preseed-system-key: {
"apparmor-features": [
"caps",
"dbus",
"domain",
"file",
"mount",
"namespaces",
"network",
"network_v8",
"policy",
"ptrace",
"query",
"rlimit",
"signal"
],
"apparmor-parser-features": [
"cap-audit-read",
"cap-bpf",
"include-if-exists",
"mqueue",
"qipcrtr-socket",
"unsafe",
"xdp"
],
"apparmor-parser-mtime": 1666191120,
"build-id": "4399dbaff2bd50a4ae62c9324bbc96def18bf9a8",
"cgroup-version": "2",
"nfs-home": false,
"overlay-root": "",
"seccomp-compiler-version": "0f51c115b973679d7ed64b550a8d9d461f7cd5c6 2.5.4 c3c9b282ef3c8dfcc3124b2aeaef62f56b813bfd21f8806b30a6c9dbc2e6e58d bpf-actlog",
"seccomp-features": [
"allow",
"errno",
"kill_process",
"kill_thread",
"log",
"trace",
"trap",
"user_notif"
],
"version": 10
}
seed-restart-system-key: {
"apparmor-features": [
"caps",
"dbus",
"domain",
"file",
"ipc",
"mount",
"namespaces",
"network",
"network_v8",
"policy",
"ptrace",
"query",
"rlimit",
"signal"
],
"apparmor-parser-features": [
"cap-audit-read",
"cap-bpf",
"include-if-exists",
"mqueue",
"qipcrtr-socket",
"unsafe",
"xdp"
],
"apparmor-parser-mtime": 1666191120,
"build-id": "4399dbaff2bd50a4ae62c9324bbc96def18bf9a8",
"cgroup-version": "2",
"nfs-home": false,
"overlay-root": "",
"seccomp-compiler-version": "0f51c115b973679d7ed64b550a8d9d461f7cd5c6 2.5.4 c3c9b282ef3c8dfcc3124b2aeaef62f56b813bfd21f8806b30a6c9dbc2e6e58d bpf-actlog",
"seccomp-features": [
"allow",
"errno",
"kill_process",
"kill_thread",
"log",
"trace",
"trap",
"user_notif"
],
"version": 10
}
[ Impact ]
* boot times for all pre-installed images are adversely affected,
causing issues for cloud partners
[ Test Plan ]
* build any cloud image
* boot
* run `snap debug preseed`
* there should not be anything in : seed-restart-system-key
[ Where problems could occur ]
* if i didn't get the exact match of features, and seed-restart-system-key is still present
* thankfully, it tells you the mismatch, so we can iterate and fix
* without this the 6.2 kernel will not be properly pre-seeded and optimized for first boot deployments.
[ Other Info ]
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2031943/+subscriptions
More information about the foundations-bugs
mailing list