[Bug 2024639] Re: apparmor features overrides for specific kernels never restored

[Launchpad Bug Tracker]

This bug was fixed in the package livecd-rootfs - 2.765.24

---------------
livecd-rootfs (2.765.24) jammy; urgency=medium

  [ Jess Jang ]
  * fix: bind correct apparmor feature for validating snap seed.
    (LP: #2024639)

  [ John Chittum ]
  * fix: 6.2 kernel missing feature. (LP: #2031943)

livecd-rootfs (2.765.23) jammy; urgency=medium

  [ Loïc Minier ]
  * Initial support for NVIDIA Tegra (LP: #2015644).

livecd-rootfs (2.765.22) jammy; urgency=medium

  * Drop use of --removable flag to grub-install from
    live-build/buildd/hooks/02-disk-image-uefi.binary, to match the cloud
    images (7c760864fdcb278ca37396f06f5e3f297428d63d).  This fixes
    bootloader updates in the buildd images, but also fixes compatibility
    with using devtmpfs for losetup.

livecd-rootfs (2.765.21) jammy; urgency=medium

  [ jchittum ]
  * add multiple kernel apparmor feature sets for snap preseeding
    (LP: #2015596).

 -- Utkarsh Gupta <utkarsh at ubuntu.com>  Sat, 19 Aug 2023 03:24:34 +0530

** Changed in: livecd-rootfs (Ubuntu Jammy)
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/2024639

Title:
  apparmor features overrides for specific kernels never restored

Status in livecd-rootfs package in Ubuntu:
  New
Status in livecd-rootfs source package in Jammy:
  Fix Released

Bug description:
  Recent changes (commit bd1690bd16c70f9631, bug is
  https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2015596)
  added a feature to livecd-rootfs to adjust the apparmor features for
  preseeding.

  But CPC builds do use derivative images. In that case, it's
  eg. possible that an image has kernel 5.19 installed (which would
  trigger the modification of apparmor features on the filesystem) and a
  derivate image (eg. the realtime kernel image) does then install a
  5.15 kernel. In that case the modifications from the 5.19 kernel would
  still be visible in /sys/kernel/security/apparmor/features/ and the
  preseeding optimizations fail.

  That's visible by calling "snap debug seeding":

  # uname -a
  Linux ip-172-31-28-91 5.15.0-1039-realtime #42-Ubuntu SMP PREEMPT_RT Wed May 17 20:46:21 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux
  # diff -u <(snap debug seeding|yq -P '.preseed-system-key') <(snap debug seeding|yq -P '.seed-restart-system-key')
  --- /dev/fd/63	2023-06-22 07:55:00.603927264 +0000
  +++ /dev/fd/62	2023-06-22 07:55:00.604927242 +0000
  @@ -3,7 +3,6 @@
     - dbus
     - domain
     - file
  -  - ipc
     - mount
     - namespaces
     - network

  [Impact]
  For some images (eg. the realtime kernel images) the preseed optimizations do not work. That affects bootspeed

  [Test Plan]
  * Build images with the fix and boot the image
  * make sure the output is:

  # snap debug seeding
  seeded:            true
  preseeded:         true
  image-preseeding:  13.682s
  seed-completion:   4.684s

  [Where problems could occur]
  Snap seed may not be validated correctly and fail CPC automation test, which will block image publication

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2024639/+subscriptions