[Bug 2024639] Update Released

[Łukasz Zemczak]

The verification of the Stable Release Update for livecd-rootfs has
completed successfully and the package is now being released to
-updates.  Subsequently, the Ubuntu Stable Release Updates Team is being
unsubscribed and will not receive messages about this bug report.  In
the event that you encounter a regression using the package from
-updates please report a new bug using ubuntu-bug and tag the bug report
regression-update so we can easily find any regressions.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/2024639

Title:
  apparmor features overrides for specific kernels never restored

Status in livecd-rootfs package in Ubuntu:
  New
Status in livecd-rootfs source package in Jammy:
  Fix Released

Bug description:
  Recent changes (commit bd1690bd16c70f9631, bug is
  https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2015596)
  added a feature to livecd-rootfs to adjust the apparmor features for
  preseeding.

  But CPC builds do use derivative images. In that case, it's
  eg. possible that an image has kernel 5.19 installed (which would
  trigger the modification of apparmor features on the filesystem) and a
  derivate image (eg. the realtime kernel image) does then install a
  5.15 kernel. In that case the modifications from the 5.19 kernel would
  still be visible in /sys/kernel/security/apparmor/features/ and the
  preseeding optimizations fail.

  That's visible by calling "snap debug seeding":

  # uname -a
  Linux ip-172-31-28-91 5.15.0-1039-realtime #42-Ubuntu SMP PREEMPT_RT Wed May 17 20:46:21 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux
  # diff -u <(snap debug seeding|yq -P '.preseed-system-key') <(snap debug seeding|yq -P '.seed-restart-system-key')
  --- /dev/fd/63	2023-06-22 07:55:00.603927264 +0000
  +++ /dev/fd/62	2023-06-22 07:55:00.604927242 +0000
  @@ -3,7 +3,6 @@
     - dbus
     - domain
     - file
  -  - ipc
     - mount
     - namespaces
     - network

  [Impact]
  For some images (eg. the realtime kernel images) the preseed optimizations do not work. That affects bootspeed

  [Test Plan]
  * Build images with the fix and boot the image
  * make sure the output is:

  # snap debug seeding
  seeded:            true
  preseeded:         true
  image-preseeding:  13.682s
  seed-completion:   4.684s

  [Where problems could occur]
  Snap seed may not be validated correctly and fail CPC automation test, which will block image publication

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2024639/+subscriptions