[Bug 2024639] Re: apparmor features overrides for specific kernels never restored

Tue Aug 22 19:07:05 UTC 2023

Tested proposed livecd-rootfs with Realtime image AWS which kernel base
is HWE but RT kernel version is 5.15 (LTS)

1. Building image with `ubuntu-bartender` from `ubuntu-old-fashioned`
    1a. project=ubuntu-cpc image-target=ec2-pro-realtime

2. Log file check
+ snap_validate_seed /tmp/tmp.ymGEaZ1Bbc
+ local CHROOT_ROOT=/tmp/tmp.ymGEaZ1Bbc
+ '[' -e /tmp/tmp.ymGEaZ1Bbc/boot/vmlinuz ']'
++ readlink --canonicalize --no-newline /tmp/tmp.ymGEaZ1Bbc/boot/vmlinuz
++ grep --extended-regexp --only-matching --max-count 1 '[0-9]+\.[0-9]+'
+ local kern_major_min=5.15
+ '[' -d /usr/share/livecd-rootfs/live-build/apparmor/5.15 ']'
+ '[' -e /tmp/tmp.ymGEaZ1Bbc/var/lib/snapd/seed/seed.yaml ']'
+ snap debug validate-seed /tmp/tmp.ymGEaZ1Bbc/var/lib/snapd/seed/seed.yaml
++ realpath /tmp/tmp.ymGEaZ1Bbc
+ /usr/lib/snapd/snap-preseed --reset /tmp/tmp.ymGEaZ1Bbc
++ realpath /tmp/tmp.ymGEaZ1Bbc
+ /usr/lib/snapd/snap-preseed /tmp/tmp.ymGEaZ1Bbc
ubuntu classic preseeding
starting to preseed root: /tmp/tmp.ymGEaZ1Bbc
using snapd binary: /tmp/snapd-preseed/usr/lib/snapd/snapd (2.59.5)
2023/08/22 13:36:56.513867 main.go:57: running for preseeding
2023/08/22 13:36:56.541899 overlord.go:272: Acquiring state lock file
2023/08/22 13:36:56.541919 overlord.go:277: Acquired state lock file
2023/08/22 13:36:56.594654 daemon.go:247: started snapd/2.59.5 (series 16; classic) ubuntu/22.04 (amd64) linux/5.15.0-1041-aws.
2023/08/22 13:36:56.610803 daemon.go:340: adjusting startup timeout by 30s (pessimistic estimate of 30s plus 5s per snap)
2023/08/22 13:36:56.624055 backends.go:58: AppArmor status: apparmor is enabled and all features are available
2023/08/22 13:36:57.153210 helpers.go:146: error trying to compare the snap system key: system-key missing on disk
2023/08/22 13:37:06.764204 daemon.go:428: stopping snapd as requested
2023/08/22 13:37:06.779818 daemon.go:521: gracefully waiting for running hooks
2023/08/22 13:37:06.779836 daemon.go:523: done waiting for running hooks
2023/08/22 13:37:06.780356 overlord.go:516: Released state lock file
unmounting: /tmp/snapd-preseed

3. register image and check kernel&snap debug seeding result

ubuntu at ip-172-31-26-219:~$ snap debug seeding
seeded: true
preseeded: true
image-preseeding: 8.3s
seed-completion: 3720h29m46.734s
ubuntu at ip-172-31-26-219:~$ uname -a
Linux ip-172-31-26-219 5.15.0-1043-realtime #48-Ubuntu SMP PREEMPT_RT Thu Jul 13 20:54:21 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux

This verification shows snap seeds are validated with correct kernel
version

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/2024639

Title:
  apparmor features overrides for specific kernels never restored

Status in livecd-rootfs package in Ubuntu:
  New
Status in livecd-rootfs source package in Jammy:
  Fix Committed

Bug description:
  Recent changes (commit bd1690bd16c70f9631, bug is
  https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2015596)
  added a feature to livecd-rootfs to adjust the apparmor features for
  preseeding.

  But CPC builds do use derivative images. In that case, it's
  eg. possible that an image has kernel 5.19 installed (which would
  trigger the modification of apparmor features on the filesystem) and a
  derivate image (eg. the realtime kernel image) does then install a
  5.15 kernel. In that case the modifications from the 5.19 kernel would
  still be visible in /sys/kernel/security/apparmor/features/ and the
  preseeding optimizations fail.

  That's visible by calling "snap debug seeding":

  # uname -a
  Linux ip-172-31-28-91 5.15.0-1039-realtime #42-Ubuntu SMP PREEMPT_RT Wed May 17 20:46:21 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux
  # diff -u <(snap debug seeding|yq -P '.preseed-system-key') <(snap debug seeding|yq -P '.seed-restart-system-key')
  --- /dev/fd/63	2023-06-22 07:55:00.603927264 +0000
  +++ /dev/fd/62	2023-06-22 07:55:00.604927242 +0000
  @@ -3,7 +3,6 @@
     - dbus
     - domain
     - file
  -  - ipc
     - mount
     - namespaces
     - network

  [Impact]
  For some images (eg. the realtime kernel images) the preseed optimizations do not work. That affects bootspeed

  [Test Plan]
  * Build images with the fix and boot the image
  * make sure the output is:

  # snap debug seeding
  seeded:            true
  preseeded:         true
  image-preseeding:  13.682s
  seed-completion:   4.684s

  [Where problems could occur]
  Snap seed may not be validated correctly and fail CPC automation test, which will block image publication

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2024639/+subscriptions