[Bug 2045384] Re: AppArmor patch for mq-posix interface is missing in jammy

[Isaac True]

Confirmed fixed in linux/5.15.0-94.104 using the itrue-mqtest-provider
and itrue-mqtest-client snaps.

Test procedure:

sudo snap install itrue-mqtest-provider itrue-mqtest-client
sudo snap connect itrue-mqtest-client:itrue-mqtest-all-perms itrue-mqtest-provider:itrue-mqtest-all-perms 
sudo snap connect itrue-mqtest-client:itrue-mqtest-default itrue-mqtest-provider:itrue-mqtest-default  
sudo snap connect itrue-mqtest-client:itrue-mqtest-ro itrue-mqtest-provider:itrue-mqtest-ro  
sudo snap connect itrue-mqtest-client:itrue-mqtest-rw itrue-mqtest-provider:itrue-mqtest-rw  

Before upgrading (on kernel 5.15.0-1048-kvm):

ubuntu at concise-pangolin:~$ sudo itrue-mqtest-provider
MQ "/test-default" failed: File exists
ubuntu at concise-pangolin:~$ sudo itrue-mqtest-client.all
MQ "/test-all-perms" failed: Operation not permitted
Test failed

After upgrading (5.15.0-94-generic):

(in first terminal)
ubuntu at concise-pangolin:~$ sudo itrue-mqtest-provider
MQ "/test-default" created
MQ "/test-ro" created
MQ "/test-rw" created
MQ "/test-all-perms" created
MQ "/test-default": 0xDEADBEEF
MQ "/test-all-perms": 0xDEADBEEF

(in second terminal)
ubuntu at concise-pangolin:~$ sudo itrue-mqtest-client.default
Test succeeded
ubuntu at concise-pangolin:~$ sudo itrue-mqtest-client.all
Test succeeded

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/2045384

Title:
  AppArmor patch for mq-posix interface is missing in jammy

Status in linux package in Ubuntu:
  Triaged
Status in livecd-rootfs package in Ubuntu:
  New
Status in linux source package in Jammy:
  Fix Committed
Status in livecd-rootfs source package in Jammy:
  New

Bug description:
  [ Impact ]

  mq-posix snapd interface does not work on Ubuntu Core 22. It results
  in permission denied even all interfaces are connected.

  Our brandstore customer is using posix message queue for IPC between
  snaps. They added mq-posix interface and connected them properly but
  getting permission denied error.

  The AppArmor patch for posix message queue created for other customer
  did not land in the standard jammy kernel.

  Userspace support for AppArmor message queue handling is already
  present in Ubuntu Core 22, it is just missing from the kernel.

  [ Test Plan ]

   * Create snaps using the posix-mq snapd interface on Ubuntu Core 22 or Classic 22.04 with the standard kernel.
   * Example snaps for testing: https://code.launchpad.net/~itrue/+git/mqtest-provider and https://code.launchpad.net/~itrue/+git/mqtest-client

  [ Where problems could occur ]

   * The patches already exist for 5.15 and have been used on other
  private customer kernels and all kernels released after 22.04, so
  there is already a good track record for this patchset and it
  shouldn't create any issues.

  [ Other Info ]
   
   * This is a time-sensitive issue for a paying customer

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2045384/+subscriptions